@vostride/agent-qa-core 0.2.2 → 0.2.4

package/dist/index.js

@@ -122,7 +122,9 @@ var NamedLLMConfigSchema = ModelConfigBaseSchema.extend({
 var TimeoutConfigSchema = z2.object({
   step: DurationString,
   test: DurationString,
-  navigation: DurationString
+  navigation: DurationString.describe(
+    "How long a web page load or URL wait can take. Default 2m. Android and iOS runs do not use it."
+  )
 }).strict();
 var BrowserConfigSchema = z2.object({
   name: z2.enum(["chromium", "firefox", "webkit"]),
@@ -132,7 +134,6 @@ var BrowserConfigSchema = z2.object({
     height: z2.number()
   }).strict().optional()
 }).strict();
-var TransportSchema = z2.enum(["local", "browserstack"]);
 var PlannerConfigSchema = z2.object({
   maxActions: z2.number().int().positive().optional(),
   maxPlanningTurns: z2.number().int().positive().optional(),
@@ -156,69 +157,28 @@ var DashboardConfigSchema = z3.object({
   port: z3.number().optional(),
   dbPath: z3.string().optional(),
   artifactsDir: z3.string().optional(),
-  // Phase 387, D-10: where an entity card's `url` points. BOTH optional, so the v52 default
-  // is a card with no `url` at all rather than a link to a route nothing serves. The card
-  // producer reads these through the masked config reader and renders
-  // `ENTITY_URL_ROUTE` (@vostride/agent-qa-schema) against them.
-  //
-  // They live on the EXISTING `services.dashboard` block rather than on a new top-level
-  // `dashboard` key: this project already has one dashboard configuration home, and a second
-  // one would be two places an operator could reasonably write the same fact.
-  //
-  // 2026-09-01 (Phase 408 plan 10, WR-04 — T-408-16): REFINED TO AN ABSOLUTE http(s) URL, because
-  // this value stops being a display string in M5. It composes the tokenless live link
-  // (`live-link.ts`'s `liveRunLinkOf`, which only strips trailing slashes), and that link is
-  // assigned to an `href` INSIDE the served App document — which runs with `allow-scripts` at an
-  // opaque origin — as well as appended verbatim to every carrier tool result's model-readable
-  // text. A `javascript:` base therefore composed a script-executing anchor. The trust boundary is
-  // the operator, so this is not remote-triggerable; the finding is that a URL-shaped value reached
-  // an `href` with no scheme check at any hop, and the guard costs one refinement.
-  //
-  // AT THE PARSE BOUNDARY, so there is exactly one place that decides. The defensive drop at the
-  // anchor itself is the SECOND half of the same finding and lives in `app-wrapper.ts`.
-  //
-  // STILL `.optional()`: an absent base is a real and honest posture — a standalone `agent-qa mcp`
-  // with no dashboard — and the carrier result names that absence rather than fabricating a URL.
-  // An EMPTY STRING is now REFUSED, which is stricter than before: `""` is not an absence an
-  // operator wrote by leaving the key out, it is a value that composes a relative fragment reading
-  // as a link and resolving against nothing.
+  // Only an absolute http(s) URL: the base composes an `href` inside the served App document.
   baseUrl: z3.string().refine(
     isAbsoluteHttpUrl,
     { message: "services.dashboard.baseUrl must be an absolute http(s) URL" }
   ).optional(),
   workspace: z3.string().optional(),
-  // 2026-10-01 (432-22, D-12/D-22): `runServiceTokens` is deleted. The run service is tokenless
-  // since 432-21, and a file that still declares the key gets the normal strict unrecognized-key
-  // error, with no migration and no special message. The local doors never needed a credential.
-  // Phase 402 D-07: the interface this server binds. Consumed by 402-05's pre-listen bind guard,
-  // which REFUSES any non-loopback value — unconditionally since the phase-402 verification round
-  // (a declared run-service credential authenticates the three run-service paths and nothing else,
-  // so it was never evidence that the rest of this server's surface was authed).
-  //
-  // DELIBERATELY NOT `LoopbackHostSchema` even so. That schema refuses at PARSE time, which would
-  // make the runtime refusal unreachable and would report the problem as a config-shape error
-  // rather than as the security refusal it is — and it would also refuse a loopback SPELLING this
-  // field exists to allow (`localhost`, `::1`, `127.0.0.2` is refused on purpose).
+  // The run service and the other local doors are tokenless, so this block declares no token key.
+  // The interface the dashboard binds. A plain string, because the pre-listen bind guard refuses
+  // any non-loopback value at runtime, as the security refusal it is rather than a config-shape
+  // error, and a loopback spelling other than the default (`localhost`, `::1`) stays configurable.
   host: z3.string().trim().min(1).optional()
 }).strict();
 var LOOPBACK_HOSTS = Object.freeze(["localhost", "127.0.0.1", "::1"]);
 function isLoopbackHost(host) {
   return LOOPBACK_HOSTS.includes(host.trim());
 }
-var LoopbackHostSchema = z3.string().trim().min(1).refine(
-  isLoopbackHost,
-  { message: "MCP host must be localhost, 127.0.0.1, or ::1 in local-only mode" }
-);
 var McpConfigSchema = z3.object({
   enabled: z3.boolean().optional(),
-  transport: z3.enum(["http", "stdio"]).optional(),
-  host: LoopbackHostSchema.optional(),
-  port: z3.number().int().min(1).max(65535).optional(),
-  path: z3.string().trim().min(1).regex(/^\//, "MCP path must start with /").optional()
+  port: z3.number().int().min(1).max(65535).optional()
 }).strict();
 var CacheConfigSchema = z3.object({
-  dir: z3.string(),
-  ttl: DurationString
+  dir: z3.string()
 }).strict();
 var AuthStateConfigSchema = z3.object({
   dir: z3.string().trim().min(1)
@@ -233,7 +193,7 @@ var RecordingConfigSchema = z3.object({
 var AccessibilityConfigSchema = z3.object({
   enabled: z3.boolean(),
   standard: z3.enum(["wcag2a", "wcag2aa", "wcag2aaa"]).optional(),
-  runAfter: z3.enum(["every-step", "navigation", "test-end"]).optional(),
+  runAfter: z3.enum(["every-step", "test-end"]).optional(),
   failOnViolation: z3.boolean().optional(),
   disableRules: z3.array(z3.string()).optional(),
   exclude: z3.array(z3.string()).optional()
@@ -260,14 +220,7 @@ var isRepoRelative = (dir) => !/^[/\\]|^[A-Za-z]:[\\/]/.test(dir) && !/^\.\.(?:[
 var KnowledgeConfigSchema = z4.object({
   dir: z4.string().trim().min(1).refine(isRepoRelative, {
     message: "knowledge.dir must be repo-relative \u2014 the committed knowledge root must live inside the repo for PR review and the committed .gitignore split"
-  }).default("agent-qa-knowledge"),
-  // D-08: closed enum — deliberately no 'full' mode; full-res artifacts ride the
-  // artifact store/git-LFS side channel per knowledge-store.md §5.
-  commitArtifacts: z4.enum(["none", "thumbnails"]).default("none"),
-  // Absent = no cap: the engine's derived budget serves everything it ranks useful; when set
-  // it is a hard ceiling min(cap, derived), clamped above min_brief — efficacy over token
-  // saving (D-09, binds Phase 380 brief budgeting).
-  contextBudgetTokens: z4.number().int().positive().optional()
+  }).default("agent-qa-knowledge")
 }).strict();
 
 // src/schema/retired-keys.ts
@@ -288,6 +241,39 @@ var RETIRED_MEMORY_KEY_MESSAGES = {
   circuitBreakerBaselineSize: "services.memory.circuitBreakerBaselineSize was removed \u2014 no circuit breaker exists",
   circuitBreakerThreshold: "services.memory.circuitBreakerThreshold was removed \u2014 no circuit breaker exists"
 };
+var RETIRED_EVAL_KEY_MESSAGES = {
+  gate1: "eval.gate1 was removed: memory is no longer screened by replay before promotion. Delete this block.",
+  gate2: "eval.gate2 was removed: completed runs no longer replay served memory. Delete this block.",
+  adversarial: "eval.adversarial was removed: runs no longer stage adversarial probes. Delete this block.",
+  seeding: "eval.seeding was removed: runs no longer seed an eval corpus. Delete this block.",
+  judge: "eval.judge was removed: pass --judge <name> to agent-qa eval replay. Delete this key.",
+  judges: "eval.judges was removed: repeat --judge <name> on agent-qa eval replay. Delete this key.",
+  judgeAllowSameFamily: "eval.judgeAllowSameFamily was removed: pass --judge-allow-same-family to agent-qa eval replay. Delete this key.",
+  k: "eval.k was removed: pass --k <n> to agent-qa eval replay. Delete this key.",
+  seed: "eval.seed was removed: pass --seed <n> to agent-qa eval replay. Delete this key."
+};
+var RETIRED_STEP_KEY_MESSAGES = {
+  retries: "steps[].retries was removed: a test retries as a whole; set meta.retries. Delete this line.",
+  screenshot: "steps[].screenshot was removed: screenshots are set per run; pass --screenshot-mode every-step to agent-qa run. Delete this line."
+};
+var RETIRED_EVAL_BLOCK_MESSAGE = "eval was removed: agent-qa eval replay takes its settings as flags. Delete this block.";
+var RETIRED_ALLOW_PRODUCTION_MESSAGE = "allowProduction was removed: production targets run like any other target. Delete this line.";
+var RETIRED_REGISTRY_PROVIDERS_MESSAGE = "registry.providers was removed: BrowserStack is no longer supported; runs use local Playwright and Appium. Delete this block.";
+var RETIRED_DEVICE_TRANSPORT_MESSAGE = "registry.devices.<name>.transport was removed: devices run on local Appium. Delete this line.";
+var RETIRED_APP_BROWSERSTACK_MESSAGE = "registry.targets.<name>.app.browserstack was removed: BrowserStack is no longer supported; app.path is the app file. Delete this line.";
+var RETIRED_CACHE_TTL_MESSAGE = "services.cache.ttl was removed: cached plans do not expire by age. Delete this line.";
+var RETIRED_MCP_KEY_MESSAGES = {
+  host: "services.mcp.host was removed: agent-qa mcp always listens on 127.0.0.1. Delete this line.",
+  path: "services.mcp.path was removed: the MCP server answers on any path. Delete this line.",
+  transport: "services.mcp.transport was removed: agent-qa mcp uses stdio, or HTTP with --http. Delete this line."
+};
+var RETIRED_RUN_AFTER_NAVIGATION_MESSAGE = "services.accessibility.runAfter: navigation was removed: it never ran a check. Use test-end, or delete the line for every-step.";
+var RETIRED_KNOWLEDGE_KEY_MESSAGES = {
+  contextBudgetTokens: "knowledge.contextBudgetTokens was removed: agent-qa sizes each run's knowledge itself. Delete this line.",
+  commitArtifacts: "knowledge.commitArtifacts was removed: knowledge bundles never commit images. Delete this line."
+};
+var RETIRED_LOCAL_PROVIDERS_MESSAGE = "providers was removed: BrowserStack is no longer supported. Delete this block.";
+var RETIRED_LOCAL_APP_BROWSERSTACK_MESSAGE = "apps.<name>.browserstack was removed: BrowserStack is no longer supported; apps.<name>.path is the app file. Delete this line.";
 var RETIRED_MAX_SUB_ACTIONS_MESSAGE = "use.planner.maxSubActions was removed in v2 \u2014 it was a refilling iteration count; set use.planner.maxActions (default 30) and use.planner.maxPlanningTurns (default 30)";
 var RETIRED_PLANNER_KEY = "maxSubActions";
 function isPlainObject(value) {
@@ -301,7 +287,7 @@ var retiredKeyScan = z5.any().superRefine((value, ctx) => {
   if (isPlainObject(value.services) && value.services.memory !== void 0) {
     ctx.addIssue({
       code: z5.ZodIssueCode.custom,
-      params: { retired: true },
+      params: { retired: true, hardCut: true },
       path: ["services", "memory"],
       message: "services.memory was removed in v2 \u2014 the memory config surface collapsed into the top-level knowledge block"
     });
@@ -312,7 +298,7 @@ var retiredKeyScan = z5.any().superRefine((value, ctx) => {
         if (message) {
           ctx.addIssue({
             code: z5.ZodIssueCode.custom,
-            params: { retired: true },
+            params: { retired: true, hardCut: true },
             path: ["services", "memory", key],
             message
           });
@@ -323,30 +309,164 @@ var retiredKeyScan = z5.any().superRefine((value, ctx) => {
   if (isPlainObject(value.workspace) && value.workspace.agentRules !== void 0) {
     ctx.addIssue({
       code: z5.ZodIssueCode.custom,
-      params: { retired: true },
+      params: { retired: true, hardCut: true },
       path: ["workspace", "agentRules"],
       message: "workspace.agentRules was removed in v2 \u2014 rules dissolve into agent-qa-knowledge/policies/<scope>.md files"
     });
   }
-  if (hasRetiredPlannerKey(value.use)) {
+  if (Object.hasOwn(value, "eval")) {
+    let named = 0;
+    if (isPlainObject(value.eval)) {
+      for (const key of Object.keys(value.eval)) {
+        if (Object.hasOwn(RETIRED_EVAL_KEY_MESSAGES, key)) {
+          named++;
+          ctx.addIssue({
+            code: z5.ZodIssueCode.custom,
+            params: { retired: true },
+            path: ["eval", key],
+            message: RETIRED_EVAL_KEY_MESSAGES[key]
+          });
+        }
+      }
+    }
+    if (named === 0) {
+      ctx.addIssue({
+        code: z5.ZodIssueCode.custom,
+        params: { retired: true },
+        path: ["eval"],
+        message: RETIRED_EVAL_BLOCK_MESSAGE
+      });
+    }
+  }
+  if (Object.hasOwn(value, "allowProduction")) {
     ctx.addIssue({
       code: z5.ZodIssueCode.custom,
       params: { retired: true },
+      path: ["allowProduction"],
+      message: RETIRED_ALLOW_PRODUCTION_MESSAGE
+    });
+  }
+  if (isPlainObject(value.registry) && Object.hasOwn(value.registry, "providers")) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      params: { retired: true },
+      path: ["registry", "providers"],
+      message: RETIRED_REGISTRY_PROVIDERS_MESSAGE
+    });
+  }
+  if (isPlainObject(value.registry) && isPlainObject(value.registry.devices)) {
+    for (const [name, device] of Object.entries(value.registry.devices)) {
+      if (isPlainObject(device) && Object.hasOwn(device, "transport")) {
+        ctx.addIssue({
+          code: z5.ZodIssueCode.custom,
+          params: { retired: true },
+          path: ["registry", "devices", name, "transport"],
+          message: RETIRED_DEVICE_TRANSPORT_MESSAGE
+        });
+      }
+    }
+  }
+  if (isPlainObject(value.registry) && isPlainObject(value.registry.targets)) {
+    for (const [name, target] of Object.entries(value.registry.targets)) {
+      if (isPlainObject(target) && isPlainObject(target.app) && Object.hasOwn(target.app, "browserstack")) {
+        ctx.addIssue({
+          code: z5.ZodIssueCode.custom,
+          params: { retired: true },
+          path: ["registry", "targets", name, "app", "browserstack"],
+          message: RETIRED_APP_BROWSERSTACK_MESSAGE
+        });
+      }
+    }
+  }
+  if (isPlainObject(value.services) && isPlainObject(value.services.cache) && Object.hasOwn(value.services.cache, "ttl")) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      params: { retired: true },
+      path: ["services", "cache", "ttl"],
+      message: RETIRED_CACHE_TTL_MESSAGE
+    });
+  }
+  if (isPlainObject(value.services) && isPlainObject(value.services.mcp)) {
+    for (const key of Object.keys(value.services.mcp)) {
+      if (Object.hasOwn(RETIRED_MCP_KEY_MESSAGES, key)) {
+        ctx.addIssue({
+          code: z5.ZodIssueCode.custom,
+          params: { retired: true },
+          path: ["services", "mcp", key],
+          message: RETIRED_MCP_KEY_MESSAGES[key]
+        });
+      }
+    }
+  }
+  if (isPlainObject(value.services) && isPlainObject(value.services.accessibility) && value.services.accessibility.runAfter === "navigation") {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      params: { retired: true },
+      path: ["services", "accessibility", "runAfter"],
+      message: RETIRED_RUN_AFTER_NAVIGATION_MESSAGE
+    });
+  }
+  if (isPlainObject(value.knowledge)) {
+    for (const key of Object.keys(value.knowledge)) {
+      if (Object.hasOwn(RETIRED_KNOWLEDGE_KEY_MESSAGES, key)) {
+        ctx.addIssue({
+          code: z5.ZodIssueCode.custom,
+          params: { retired: true },
+          path: ["knowledge", key],
+          message: RETIRED_KNOWLEDGE_KEY_MESSAGES[key]
+        });
+      }
+    }
+  }
+  if (hasRetiredPlannerKey(value.use)) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      params: { retired: true, hardCut: true },
       path: ["use", "planner", RETIRED_PLANNER_KEY],
       message: RETIRED_MAX_SUB_ACTIONS_MESSAGE
     });
   }
 });
+function refuseRetiredLocalBindings(raw, filePath) {
+  if (!isPlainObject(raw)) return;
+  const issues = [];
+  if (Object.hasOwn(raw, "providers")) {
+    issues.push({ path: "providers", message: RETIRED_LOCAL_PROVIDERS_MESSAGE });
+  }
+  if (isPlainObject(raw.apps)) {
+    for (const [name, app] of Object.entries(raw.apps)) {
+      if (isPlainObject(app) && Object.hasOwn(app, "browserstack")) {
+        issues.push({ path: `apps.${name}.browserstack`, message: RETIRED_LOCAL_APP_BROWSERSTACK_MESSAGE });
+      }
+    }
+  }
+  if (issues.length === 0) return;
+  throw new Error(
+    [`${filePath}:`, ...issues.map((issue) => `  ${issue.path}: ${issue.message}`)].join("\n")
+  );
+}
 var retiredUseKeyScan = z5.any().superRefine((value, ctx) => {
   if (hasRetiredPlannerKey(value)) {
     ctx.addIssue({
       code: z5.ZodIssueCode.custom,
-      params: { retired: true },
+      params: { retired: true, hardCut: true },
       path: ["planner", RETIRED_PLANNER_KEY],
       message: RETIRED_MAX_SUB_ACTIONS_MESSAGE
     });
   }
 });
+var retiredStepKeyScan = z5.any().superRefine((value, ctx) => {
+  if (!isPlainObject(value)) return;
+  for (const [key, message] of Object.entries(RETIRED_STEP_KEY_MESSAGES)) {
+    if (!Object.hasOwn(value, key)) continue;
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      params: { retired: true },
+      path: [key],
+      message
+    });
+  }
+});
 
 // src/schema/registry-schema.ts
 import { z as z7 } from "zod";
@@ -376,8 +496,7 @@ function isAbsoluteAppPath(value) {
   return value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 }
 var AppInstallSchema = z7.object({
-  path: z7.string().refine((v) => !isAbsoluteAppPath(v), { message: "app.path must be relative" }).optional(),
-  browserstack: z7.string().optional()
+  path: z7.string().refine((v) => !isAbsoluteAppPath(v), { message: "app.path must be relative" }).optional()
 }).strict();
 var TargetSchema = z7.object({
   product: z7.string().refine(
@@ -390,15 +509,8 @@ var TargetSchema = z7.object({
   appActivity: z7.string().optional(),
   app: AppInstallSchema.optional(),
   url: z7.string().optional(),
-  // D-06 (phase 401): which environment a run against this target actually touches. Deliberately
-  // `.optional()` with NO default — an undeclared target must stay visibly undeclared; since 432
-  // (D-18) undeclared means non-production, decided where the production refusal reads it (the
-  // run gate that decided "shared" is deleted). A default here would make silence and an honest
-  // declaration indistinguishable at every later reader, and
-  // `.strict()` above is what turns a typoed key into a refusal rather than a silent undeclared.
-  // 432 D-18: `production` is the third declared class; only top-level `allowProduction: true`
-  // opts a run into it.
-  environment: z7.enum(["local", "shared", "production"]).optional()
+  // A label only: agent-qa runs every target the same way, whatever it declares.
+  environment: z7.enum(["local", "shared", "production"]).optional().describe("A label for this target's environment. agent-qa runs every target the same way.")
 }).strict().superRefine((val, ctx) => {
   if (val.platform === "web" && !val.url) {
     ctx.addIssue({ code: z7.ZodIssueCode.custom, message: "Web targets must have a url" });
@@ -406,30 +518,25 @@ var TargetSchema = z7.object({
 });
 var DeviceProfileSchema = z7.object({
   platform: z7.enum(["android", "ios"]),
-  transport: TransportSchema,
   match: z7.record(z7.string(), z7.unknown()).optional().default({})
 }).strict().superRefine((val, ctx) => {
-  if (val.transport === "local") {
-    const androidOnly = ["avd", "serial", "appPackage", "appActivity", "automationName", "browserName", "platformVersion"];
-    const iosOnly = ["udid", "bundleId", "automationName", "platformVersion"];
-    const allowed = val.platform === "android" ? androidOnly : iosOnly;
-    for (const key of Object.keys(val.match)) {
-      if (!allowed.includes(key)) {
-        ctx.addIssue({
-          code: z7.ZodIssueCode.custom,
-          path: ["match", key],
-          message: `Match field "${key}" is not valid for ${val.platform} local transport. Allowed: ${allowed.join(", ")}`
-        });
-      }
+  const androidOnly = ["avd", "serial", "appPackage", "appActivity", "automationName", "browserName", "platformVersion"];
+  const iosOnly = ["udid", "bundleId", "automationName", "platformVersion"];
+  const allowed = val.platform === "android" ? androidOnly : iosOnly;
+  for (const key of Object.keys(val.match)) {
+    if (!allowed.includes(key)) {
+      ctx.addIssue({
+        code: z7.ZodIssueCode.custom,
+        path: ["match", key],
+        message: `Match field "${key}" is not valid for an ${val.platform} device. Allowed: ${allowed.join(", ")}`
+      });
     }
   }
 });
-var ProviderConfigSchema = z7.record(z7.string(), z7.unknown());
 var RegistrySchema = z7.object({
   llms: z7.array(NamedLLMConfigSchema).optional().default([]),
   targets: z7.record(TargetNameSchema, TargetSchema).optional(),
-  devices: z7.record(z7.string(), DeviceProfileSchema).optional(),
-  providers: z7.record(z7.string(), ProviderConfigSchema).optional()
+  devices: z7.record(z7.string(), DeviceProfileSchema).optional()
 }).strict();
 
 // src/schema/use-schema.ts
@@ -473,28 +580,11 @@ var UseSchema = z8.object({
   logCapture: LogCaptureConfigSchema.optional(),
   cache: z8.boolean().optional(),
   llm: z8.string().optional(),
-  /**
-   * Names the app-under-test build for the DCAY-01 buildTag-to-ordinal mapping.
-   * Precedence: CLI --build-tag > AGENT_QA_BUILD_TAG > this config key.
-   */
+  // Precedence: CLI `--build-tag`, then `AGENT_QA_BUILD_TAG`, then this key.
   buildTag: z8.string().trim().min(1).optional(),
-  /**
-   * 402-03 (D-12): run the members of one run CONCURRENTLY. Absent or false is one member at a
-   * time — today's behaviour, byte for byte.
-   */
+  // Runs one run's members concurrently; absent or false runs one member at a time.
   parallel: z8.boolean().optional(),
-  /**
-   * 402-03 (D-12): the ceiling on concurrent members when `parallel` is true. Absent resolves to
-   * `DEFAULT_PARALLEL_WORKERS` (3). Effective concurrency is `min(memberCount, workers)`, decided
-   * in exactly one place — `resolveEffectiveWorkers` in `@vostride/agent-qa-schema`.
-   *
-   * A POSITIVE INTEGER, refused otherwise: an unbounded or nonsensical count here is the only
-   * reachable input to a concurrency denial-of-service (T-402-12), and it is a config typo rather
-   * than a caller's field — `RunsStartInput` names neither of these two.
-   *
-   * NOT `.default(...)`: a defaulted key changes the PARSED config type and every hand-built
-   * config fixture would then need it. The default is the resolver's, not the schema's.
-   */
+  // Not defaulted, so the parsed type is unchanged; `resolveEffectiveWorkers` owns the default.
   workers: z8.number().int().positive().optional()
 }).strict();
 var UseOverrideSchema = z8.object({
@@ -509,7 +599,9 @@ var UseOverrideSchema = z8.object({
   timeout: z8.object({
     step: DurationString.optional(),
     test: DurationString.optional(),
-    navigation: DurationString.optional()
+    navigation: DurationString.optional().describe(
+      "How long a web page load or URL wait can take. Default 2m. Android and iOS runs do not use it."
+    )
   }).strict().optional(),
   planner: z8.object({
     maxActions: z8.number().int().positive().optional(),
@@ -525,7 +617,7 @@ var UseOverrideSchema = z8.object({
   mobile: MobileUseOverrideSchema.optional(),
   llm: z8.string().optional(),
   parallel: z8.boolean().optional(),
-  /** 402-03 (D-12): the override half of `use.workers`. Same shape as `UseSchema`'s. */
+  // The override half of `use.workers`, shaped like `UseSchema`'s.
   workers: z8.number().int().positive().optional(),
   device: z8.string().optional()
 }).strict();
@@ -569,82 +661,15 @@ var PluginsSchema = z10.object({
 var AgentQaConfigSchemaInner = z10.object({
   workspace: WorkspaceSchema,
   services: ServicesSchema.prefault({}).optional(),
-  // D-08: slim replacement for the retired v1 memory config surface; prefaulted so parsed
-  // configs always materialize knowledge defaults (zod 4 .default() short-circuits without
-  // parsing — .prefault() runs the inner defaults) — matches the providers `.default([])`
-  // precedent in spirit.
+  // `.prefault` runs the inner defaults; zod 4's `.default()` short-circuits without parsing.
   knowledge: KnowledgeConfigSchema.prefault({}),
   registry: RegistrySchema.optional(),
   use: UseSchema.optional(),
   plugins: PluginsSchema.optional(),
-  analytics: AnalyticsSchema.optional(),
-  // 432 D-18: the one production opt-in. Optional with no default: its consumer reads absence as
-  // false, so only an explicit `true` in the validated config authorizes a production target.
-  allowProduction: z10.boolean().optional(),
-  // 2026-10-01 (432-22, D-15/D-18/D-22): the `safety` section (`safety.trustMode`) is deleted with
-  // trust mode. `allowProduction` above is the only production opt-in, and a file that still
-  // declares `safety` gets the normal strict unrecognized-key error.
-  // D-03 (Phase 372): eval substrate params. `judge` references a NAMED registry.llms entry;
-  // strict so unknown eval subkeys are rejected.
-  eval: z10.object({
-    judge: z10.string().min(1).refine((name) => name.trim().length > 0).optional(),
-    judges: z10.array(z10.string().min(1).refine((name) => name.trim().length > 0)).max(3).optional(),
-    // Owner override of D-10 (2026-07-12): explicit default-off opt-in that lets a
-    // KNOWN-same-family judge run; the eligibility law discloses the override on every
-    // scored entry (familyOverride) and the report projection renders one honesty line.
-    // Unknown families stay forbidden regardless.
-    judgeAllowSameFamily: z10.boolean().optional(),
-    k: z10.number().int().positive().optional(),
-    seed: z10.number().int().optional(),
-    // 2026-09-07, 417 D-19: Gate-1 screen cap; recorded default lives in the CLI.
-    // 2026-09-11, 422 D-14: `maxPerJob` bounds how many Gate-1 CALLS one post-run proposal job
-    // may make; recorded default lives beside the handler (PROPOSE_DEFAULT_MAX_GATE1_PER_JOB).
-    // A SECOND axis beside `maxScreens`, not a refinement of it — that one bounds how much a
-    // single screening looks at, this one bounds how many screenings a run's tail buys — and an
-    // operator can legitimately want a generous first and a tight second. Positive-integer only,
-    // for the sharper version of the usual reason: a bound that silently fell back to the
-    // recorded default because the operator typed `0` would buy replay work they refused. There
-    // is deliberately NO CLI flag: the bound is charged durably per job and read back by a
-    // resumed attempt, so a per-invocation flag would be a bound that could change between the
-    // attempt that spent it and the attempt that has to honour what was spent.
-    gate1: z10.object({
-      maxScreens: z10.number().int().positive().optional(),
-      maxPerJob: z10.number().int().positive().optional()
-    }).strict().optional(),
-    // 2026-09-07, 418 D-04/D-13/D-14: Gate-2 ablation cap, canary horizon (build ordinals)
-    // and per-scope lower-trust cap; recorded defaults live in the CLI (GATE2_DEFAULT_*).
-    gate2: z10.object({
-      maxAblations: z10.number().int().positive().optional(),
-      canaryHorizonBuilds: z10.number().int().positive().optional(),
-      maxLowerTrustPerScope: z10.number().int().positive().optional()
-    }).strict().optional(),
-    // 2026-09-11, 422 D-04: how many NOVEL seeds one adversarial refresh may derive from
-    // before the rest are counted and deferred; recorded default lives in eval core
-    // (ADVERSARIAL_DEFAULT_MAX_SEEDS_PER_REFRESH). Strict, and positive-integer only: a cap
-    // that silently fell back to the default because the operator typed `0` is not a cap.
-    // 2026-09-11, 422 D-04/D-10: `maxProbeCalls` bounds PROVIDER CALLS one refresh may make to
-    // author probes; recorded default lives in eval-local
-    // (ADVERSARIAL_DEFAULT_MAX_PROBE_CALLS). It is a SECOND budget beside the seed cap on
-    // purpose — deterministic seeds cost CPU and authored probes cost money no later run can
-    // recover — and it is held to the same positive-integer strictness for the sharper version
-    // of the same reason: a cap that silently fell back to the default because the operator
-    // typed `0` would buy calls they refused.
-    adversarial: z10.object({
-      maxSeedsPerRefresh: z10.number().int().positive().optional(),
-      maxProbeCalls: z10.number().int().positive().optional()
-    }).strict().optional(),
-    seeding: z10.object({
-      silverPerTestCap: z10.number().int().positive().optional()
-    }).strict().optional()
-  }).strict().optional()
+  analytics: AnalyticsSchema.optional()
+  // There is no `safety` section: a file that still declares one gets the normal strict
+  // unrecognized-key error.
 }).strict().superRefine((val, ctx) => {
-  if (val.eval?.judge !== void 0 && val.eval.judges !== void 0) {
-    ctx.addIssue({
-      code: z10.ZodIssueCode.custom,
-      path: ["eval"],
-      message: "Set either eval.judge or eval.judges, never both; remove one declaration."
-    });
-  }
   const llms = val.registry?.llms ?? [];
   const names = llms.map((c) => c.name);
   const dupes = names.filter((n, i) => names.indexOf(n) !== i);
@@ -669,13 +694,6 @@ var AgentQaConfigSchemaInner = z10.object({
       message: `use.llm "${val.use.llm}" does not match any name in registry.llms`
     });
   }
-  if (!MobileAppStateSchema.safeParse(val.use?.mobile?.appState).success) {
-    ctx.addIssue({
-      code: z10.ZodIssueCode.custom,
-      path: ["use", "mobile", "appState"],
-      message: "use.mobile.appState is required and must be one of: preserve | reset"
-    });
-  }
 });
 var AgentQaConfigSchema = retiredKeyScan.pipe(AgentQaConfigSchemaInner);
 
@@ -698,8 +716,6 @@ var TestStepSchema = z11.union([
   z11.object({
     step: z11.string(),
     timeout: OptionalDuration,
-    retries: z11.number().optional(),
-    screenshot: z11.boolean().optional(),
     capture: CaptureConfigSchema.optional()
   }).strict()
 ]);
@@ -722,19 +738,9 @@ var TestDefinitionSchema = z11.object({
   meta: TestMetaSchema.optional(),
   setup: z11.array(HookIdSchema).optional(),
   teardown: z11.array(HookIdSchema).optional(),
-  steps: z11.array(TestStepSchema).min(1)
+  steps: z11.array(retiredStepKeyScan.pipe(TestStepSchema)).min(1)
 }).strict();
 
-// src/schema/action-schema.ts
-import { z as z12 } from "zod";
-var ActionPlanSchema = z12.object({
-  reasoning: z12.string().describe("Brief explanation of why this action was chosen"),
-  action: z12.object({ type: z12.string() }).passthrough(),
-  confidence: z12.number().describe("Confidence level from 0 to 1"),
-  stepComplete: z12.boolean().default(false).describe("Whether this action completes the step goal. Set true when the step objective is fully accomplished, false when more actions are needed."),
-  stepFailed: z12.boolean().optional().default(false).describe("Set true when the step goal cannot be achieved from the current screen state. When true, no action is executed and the step fails with the reasoning as the error message.")
-});
-
 // src/schema/resolve-knowledge-root.ts
 import path from "path";
 function resolveKnowledgeRoot(knowledge, configDir) {
@@ -742,66 +748,66 @@ function resolveKnowledgeRoot(knowledge, configDir) {
 }
 
 // src/schema/suite-schema.ts
-import { z as z13 } from "zod";
+import { z as z12 } from "zod";
 import { isCanonicalHookId as isCanonicalHookId2, isCanonicalSuiteId, isCanonicalTestId as isCanonicalTestId2 } from "@vostride/agent-qa-ids";
-var SuiteTestEntrySchema = z13.object({
-  test: z13.string(),
-  id: z13.string().refine((value) => isCanonicalTestId2(value), {
+var SuiteTestEntrySchema = z12.object({
+  test: z12.string(),
+  id: z12.string().refine((value) => isCanonicalTestId2(value), {
     message: "Test ID must be t_ followed by 10 id-agent words"
   })
 }).strict();
-var HookIdSchema2 = z13.string().refine((value) => isCanonicalHookId2(value), {
+var HookIdSchema2 = z12.string().refine((value) => isCanonicalHookId2(value), {
   message: "Hook ID must be h_ followed by 10 id-agent words"
 });
-var SuiteDefinitionSchema = z13.object({
-  "suite-id": z13.string().refine((value) => isCanonicalSuiteId(value), {
+var SuiteDefinitionSchema = z12.object({
+  "suite-id": z12.string().refine((value) => isCanonicalSuiteId(value), {
     message: "Suite ID must be s_ followed by 10 id-agent words"
   }).optional(),
-  name: z13.string(),
-  target: z13.string(),
-  context: z13.string().optional(),
-  setup: z13.array(HookIdSchema2).optional(),
-  teardown: z13.array(HookIdSchema2).optional(),
-  tests: z13.array(SuiteTestEntrySchema).min(1),
+  name: z12.string(),
+  target: z12.string(),
+  context: z12.string().optional(),
+  setup: z12.array(HookIdSchema2).optional(),
+  teardown: z12.array(HookIdSchema2).optional(),
+  tests: z12.array(SuiteTestEntrySchema).min(1),
   use: retiredUseKeyScan.pipe(UseOverrideSchema).optional()
 }).strict();
 
 // src/hooks/schema.ts
-import { z as z14 } from "zod";
+import { z as z13 } from "zod";
 import ms3 from "ms";
 import { isCanonicalHookId as isCanonicalHookId3 } from "@vostride/agent-qa-ids";
-var HookDurationString = z14.string().refine((v) => ms3(v) !== void 0, {
+var HookDurationString = z13.string().refine((v) => ms3(v) !== void 0, {
   message: 'Invalid duration format (e.g., "30s", "2m", "1h")'
 }).transform((v) => ms3(v));
 var HOOK_ID_MESSAGE = "Hook ID must be h_ followed by 10 id-agent words";
-var HookDefinitionSchema = z14.object({
-  id: z14.string().refine((value) => isCanonicalHookId3(value), {
+var HookDefinitionSchema = z13.object({
+  id: z13.string().refine((value) => isCanonicalHookId3(value), {
     message: HOOK_ID_MESSAGE
   }),
-  name: z14.string().min(1),
-  runtime: z14.enum(["node", "bun", "python", "bash"]),
-  file: z14.string().min(1),
-  deps: z14.array(z14.string()).optional().default([]),
-  packageFile: z14.string().optional(),
+  name: z13.string().min(1),
+  runtime: z13.enum(["node", "bun", "python", "bash"]),
+  file: z13.string().min(1),
+  deps: z13.array(z13.string()).optional().default([]),
+  packageFile: z13.string().optional(),
   timeout: HookDurationString,
-  network: z14.boolean().optional().default(true)
+  network: z13.boolean().optional().default(true)
 });
-var HooksFileSchema = z14.object({
-  hooks: z14.array(HookDefinitionSchema)
+var HooksFileSchema = z13.object({
+  hooks: z13.array(HookDefinitionSchema)
 }).superRefine((val, ctx) => {
   const ids = /* @__PURE__ */ new Set();
   const names = /* @__PURE__ */ new Set();
   for (let i = 0; i < val.hooks.length; i++) {
     if (ids.has(val.hooks[i].id)) {
       ctx.addIssue({
-        code: z14.ZodIssueCode.custom,
+        code: z13.ZodIssueCode.custom,
         path: ["hooks", i, "id"],
         message: `Duplicate hook id: "${val.hooks[i].id}"`
       });
     }
     if (names.has(val.hooks[i].name)) {
       ctx.addIssue({
-        code: z14.ZodIssueCode.custom,
+        code: z13.ZodIssueCode.custom,
         path: ["hooks", i, "name"],
         message: `Duplicate hook name: "${val.hooks[i].name}"`
       });
@@ -1167,7 +1173,7 @@ var PatchOpUnsupportedTargetError = class extends Error {
 var PatchedDocumentInvalidError = class extends Error {
   constructor(phase, detail) {
     super(
-      `cst-patch: the ${phase} document is not a valid test: ${detail}; a patched document is schema-validated before any caller may write it (WTST-07)`
+      `cst-patch: the ${phase} document is not a valid test: ${detail}; a patched document is schema-validated before any caller may write it`
     );
     this.phase = phase;
     this.detail = detail;
@@ -1263,7 +1269,7 @@ function resolveSeqSlot(doc, pointer, segments, op) {
   if (segments.length < 2) {
     throw new PatchOpUnsupportedTargetError(
       pointer,
-      `${op} operates on a sequence item, and that path names a top-level key; adding or removing a key is a document rewrite (D-02), not a patch`
+      `${op} operates on a sequence item, and that path names a top-level key; adding or removing a key is a document rewrite, not a patch`
     );
   }
   const parent = resolveNode(doc, segments.slice(0, -1));
@@ -1932,9 +1938,6 @@ var MobileSetupError = class extends Error {
 function isMobilePlatform(value) {
   return value === "android" || value === "ios";
 }
-function isMobileTransport(value) {
-  return value === "local" || value === "browserstack";
-}
 function asOptionalString(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
@@ -2006,11 +2009,6 @@ function resolveAppInstall(target, input, platform, deviceName, sourceTrace) {
   const pathValue = localPath ?? targetPath;
   const pathSource = localPath ? `agent-qa.local.yaml apps.${input.targetName}.path` : targetPath ? `agent-qa.config.yaml registry.targets.${input.targetName}.app.path` : void 0;
   const pathBaseDir = localPath ? baseDirFor(input.localConfigFilePath ?? input.localBindings?.filePath) : targetPath ? baseDirFor(input.configFilePath) : void 0;
-  const localBrowserStack = asOptionalString(localApp?.browserstack);
-  const targetBrowserStack = asOptionalString(target.app?.browserstack);
-  const browserstackValue = localBrowserStack ?? targetBrowserStack;
-  const browserstackSource = localBrowserStack ? `agent-qa.local.yaml apps.${input.targetName}.browserstack` : targetBrowserStack ? `agent-qa.config.yaml registry.targets.${input.targetName}.app.browserstack` : void 0;
-  const browserstackBaseDir = localBrowserStack ? baseDirFor(input.localConfigFilePath ?? input.localBindings?.filePath) : targetBrowserStack ? baseDirFor(input.configFilePath) : void 0;
   const install = { sourceTrace: installSourceTrace };
   if (pathValue) {
     if (isAbsoluteAppInstallValue(pathValue)) {
@@ -2036,23 +2034,7 @@ function resolveAppInstall(target, input, platform, deviceName, sourceTrace) {
       sourceTrace.push(`app.path=${pathSource}`);
     }
   }
-  if (browserstackValue) {
-    if (isAbsoluteAppInstallValue(browserstackValue)) {
-      throw appInstallError(`Configured BrowserStack app value must be relative or a BrowserStack reference: ${browserstackValue}`, input, {
-        platform,
-        deviceName,
-        appId: browserstackValue,
-        sourceTrace: [...sourceTrace, `app.browserstack=${browserstackSource}`]
-      });
-    }
-    install.browserstack = browserstackValue;
-    install.browserstackBaseDir = browserstackBaseDir;
-    if (browserstackSource) {
-      installSourceTrace["app.browserstack"] = browserstackSource;
-      sourceTrace.push(`app.browserstack=${browserstackSource}`);
-    }
-  }
-  return install.path || install.browserstack ? install : void 0;
+  return install.path ? install : void 0;
 }
 function resolveMobileRunConfig(input) {
   const targets = input.config.registry?.targets;
@@ -2106,7 +2088,6 @@ function resolveMobileRunConfig(input) {
       { platform, deviceName }
     );
   }
-  const transport = isMobileTransport(deviceProfile.transport) ? deviceProfile.transport : "local";
   const localMatch = input.localBindings?.devices?.[deviceName] ?? null;
   const mergedMatch = { ...deviceProfile.match ?? {}, ...localMatch ?? {} };
   const appSourceTrace = {};
@@ -2148,11 +2129,9 @@ function resolveMobileRunConfig(input) {
     platform,
     targetName: input.targetName,
     deviceName,
-    transport,
     device: {
       name: deviceName,
       platform,
-      transport,
       match: mergedMatch
     },
     app,
@@ -3120,7 +3099,7 @@ function clearLoadedProviderPluginModules() {
 }
 
 // src/logging/types.ts
-import { z as z15 } from "zod";
+import { z as z14 } from "zod";
 var LOG_LEVEL_PRIORITY = {
   silent: 0,
   error: 1,
@@ -3128,46 +3107,45 @@ var LOG_LEVEL_PRIORITY = {
   info: 3,
   debug: 4
 };
-var AgentLogDataSchema = z15.object({
-  extractDom: z15.boolean().optional(),
-  hasScreenshot: z15.boolean().optional(),
-  duration: z15.number().optional(),
-  elementCount: z15.number().optional()
+var AgentLogDataSchema = z14.object({
+  hasScreenshot: z14.boolean().optional(),
+  duration: z14.number().optional(),
+  elementCount: z14.number().optional()
 });
-var AdapterLogDataSchema = z15.object({
-  actionType: z15.string().optional(),
-  selector: z15.string().optional(),
-  coordinates: z15.object({ x: z15.number(), y: z15.number() }).optional(),
-  elementProperties: z15.record(z15.string(), z15.unknown()).optional(),
-  duration: z15.number().optional()
+var AdapterLogDataSchema = z14.object({
+  actionType: z14.string().optional(),
+  selector: z14.string().optional(),
+  coordinates: z14.object({ x: z14.number(), y: z14.number() }).optional(),
+  elementProperties: z14.record(z14.string(), z14.unknown()).optional(),
+  duration: z14.number().optional()
 });
-var CacheLogDataSchema = z15.object({
-  operation: z15.enum(["get", "set", "invalidate", "bypass", "batch-purge"]),
-  stepHash: z15.string().optional(),
-  screenHash: z15.string().optional(),
-  hit: z15.boolean().optional(),
-  age: z15.number().optional(),
-  entriesDeleted: z15.number().optional()
+var CacheLogDataSchema = z14.object({
+  operation: z14.enum(["get", "set", "invalidate", "bypass", "batch-purge"]),
+  stepHash: z14.string().optional(),
+  screenHash: z14.string().optional(),
+  hit: z14.boolean().optional(),
+  age: z14.number().optional(),
+  entriesDeleted: z14.number().optional()
 });
-var PlannerLogDataSchema = z15.object({
-  model: z15.string().optional(),
-  promptTokens: z15.number().optional(),
-  completionTokens: z15.number().optional(),
-  latencyMs: z15.number().optional(),
-  confidence: z15.number().optional(),
-  actionType: z15.string().optional()
+var PlannerLogDataSchema = z14.object({
+  model: z14.string().optional(),
+  promptTokens: z14.number().optional(),
+  completionTokens: z14.number().optional(),
+  latencyMs: z14.number().optional(),
+  confidence: z14.number().optional(),
+  actionType: z14.string().optional()
 });
-var HookLogDataSchema = z15.object({
-  hookName: z15.string().optional(),
-  phase: z15.enum(["setup", "teardown"]).optional(),
-  duration: z15.number().optional(),
-  success: z15.boolean().optional()
+var HookLogDataSchema = z14.object({
+  hookName: z14.string().optional(),
+  phase: z14.enum(["setup", "teardown"]).optional(),
+  duration: z14.number().optional(),
+  success: z14.boolean().optional()
 });
-var RunnerLogDataSchema = z15.object({
-  stepIndex: z15.number().optional(),
-  totalSteps: z15.number().optional(),
-  testName: z15.string().optional(),
-  variablesCaptured: z15.number().optional()
+var RunnerLogDataSchema = z14.object({
+  stepIndex: z14.number().optional(),
+  totalSteps: z14.number().optional(),
+  testName: z14.string().optional(),
+  variablesCaptured: z14.number().optional()
 });
 var LogSourceDataSchemas = {
   agent: AgentLogDataSchema,
@@ -3198,12 +3176,60 @@ function formatLogEntry(entry) {
   return `${time} ${level} ${source} ${entry.message}${dataSuffix}`;
 }
 
+// src/logging/run-text-output.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var STDOUT_RESERVATIONS = /* @__PURE__ */ Symbol.for("agent-qa.run-text-output.stdout-reservations");
+function stdoutReservations() {
+  const holder = globalThis;
+  holder[STDOUT_RESERVATIONS] ??= { count: 0 };
+  return holder[STDOUT_RESERVATIONS];
+}
+function isGitHubActions(env = process.env) {
+  const value = env.GITHUB_ACTIONS;
+  return value !== void 0 && value !== "" && value.toLowerCase() !== "false" && value !== "0";
+}
+function guardRunText(text, env = process.env) {
+  if (!isGitHubActions(env)) return text;
+  const token = randomBytes2(16).toString("hex");
+  const block = text.endsWith("\n") ? text : `${text}
+`;
+  return `::stop-commands::${token}
+${block}::${token}::
+`;
+}
+function guardJsonText(serialized, env = process.env) {
+  return isGitHubActions(env) ? serialized.replaceAll("#", "\\u0023") : serialized;
+}
+function reserveStdoutForData() {
+  const reservations = stdoutReservations();
+  reservations.count += 1;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    reservations.count -= 1;
+  };
+}
+function printRunText(text, print = (line) => console.log(line), options = {}) {
+  const env = options.env ?? process.env;
+  if (!isGitHubActions(env)) {
+    print(text);
+    return;
+  }
+  const block = guardRunText(text, env);
+  if (options.stdoutIsData ?? stdoutReservations().count > 0) {
+    process.stderr.write(block);
+    return;
+  }
+  process.stdout.write(block);
+}
+
 // src/logging/log-manager.ts
 import { redactSecretValue } from "@vostride/agent-qa-runner";
 var MemberLogScopeUnavailableError = class extends Error {
   constructor() {
     super(
-      "LogManager.runInMemberScope requires a memberScope store. Construct the manager with `memberScope: new AsyncLocalStorage()` \u2014 without it, concurrent members would silently share one run id (WINDOWS #233)."
+      "LogManager.runInMemberScope requires a memberScope store. Construct the manager with `memberScope: new AsyncLocalStorage()` \u2014 without it, concurrent members would silently share one run id."
     );
     this.name = "MemberLogScopeUnavailableError";
   }
@@ -3218,6 +3244,7 @@ var LogManager = class {
   ndjson;
   redactor;
   memberScope;
+  env;
   constructor(opts) {
     this.runId = opts.runId ?? "";
     this.runIdSet = !!opts.runId;
@@ -3226,21 +3253,12 @@ var LogManager = class {
     this.ndjson = opts.ndjson ?? false;
     this.redactor = opts.redactor;
     this.memberScope = opts.memberScope;
+    this.env = opts.env;
   }
   setRedactor(redactor) {
     this.redactor = redactor;
   }
-  /**
-   * Run `fn` with its own run-id binding, so concurrent members cannot overwrite each other.
-   *
-   * ONE `LogManager` SERVES EVERY MEMBER of a run — `commands/run.ts` builds it once, outside the
-   * per-member closure — and since 402-02/402-03 the direct path runs members concurrently. Without
-   * a scope, `setRunId` is a single mutable field plus a whole-buffer backfill, so the LAST member
-   * to mint an id claims every line in the buffer, its siblings' included (measured, not inferred).
-   *
-   * Outside a scope nothing changes: `setRunId` keeps its original whole-buffer behaviour, which is
-   * what the sequential path and the run-level `onRunCreated` stamp rely on.
-   */
+  // One manager serves every concurrent member; outside a scope `setRunId` backfills the buffer.
   runInMemberScope(fn) {
     if (!this.memberScope) throw new MemberLogScopeUnavailableError();
     return this.memberScope.run({ runId: this.runId, pending: [] }, fn);
@@ -3260,7 +3278,14 @@ var LogManager = class {
     this.buffer.push(entry);
     if (scope && !entry.runId) scope.pending.push(entry);
     if (this.shouldDisplay(level)) {
-      process.stderr.write(formatLogEntry(entry) + "\n");
+      printRunText(
+        formatLogEntry(entry),
+        (line) => {
+          process.stderr.write(`${line}
+`);
+        },
+        { env: this.env }
+      );
     }
     if (this.ndjson) {
       this.emitNdjson(entry);
@@ -3281,7 +3306,7 @@ var LogManager = class {
    */
   emitNdjson(entry) {
     process.stdout.write(
-      `AGENT_QA_EVENT:${JSON.stringify({ type: "log", ...entry })}
+      `AGENT_QA_EVENT:${guardJsonText(JSON.stringify({ type: "log", ...entry }), this.env)}
 `
     );
   }
@@ -3329,263 +3354,6 @@ var LogManager = class {
   }
 };
 
-// src/farm/credentials.ts
-var ENV_MAP = {
-  browserstack: {
-    username: "BROWSERSTACK_USERNAME",
-    accessKey: "BROWSERSTACK_ACCESS_KEY"
-  }
-};
-var DISPLAY_NAMES = {
-  browserstack: "BrowserStack"
-};
-function resolveFarmCredentials(provider, providerConfig) {
-  const envKeys = ENV_MAP[provider];
-  if (!envKeys) {
-    throw new Error(`Unknown farm provider: ${provider}`);
-  }
-  const envUsername = process.env[envKeys.username];
-  const envAccessKey = process.env[envKeys.accessKey];
-  if (envUsername && envAccessKey) {
-    return { username: envUsername, accessKey: envAccessKey };
-  }
-  if (providerConfig?.username && providerConfig?.accessKey) {
-    return { username: providerConfig.username, accessKey: providerConfig.accessKey };
-  }
-  const displayName = DISPLAY_NAMES[provider] ?? provider;
-  throw new Error(
-    `${displayName} credentials not found. Set ${envKeys.username} and ${envKeys.accessKey} env vars, or add provider credentials to agent-qa.local.yaml.`
-  );
-}
-
-// src/farm/capability-mapper.ts
-import { createRequire as createRequire2 } from "module";
-var BROWSER_MAP = {
-  chromium: "playwright-chromium",
-  firefox: "playwright-firefox",
-  webkit: "playwright-webkit"
-};
-function detectPlaywrightVersion() {
-  try {
-    const require4 = createRequire2(typeof __filename === "string" ? __filename : import.meta.url);
-    const pkg = require4("playwright-core/package.json");
-    return pkg.version;
-  } catch {
-    return "1.59.1";
-  }
-}
-function mapWebCapabilities(browser, credentials, opts) {
-  if (!browser.viewport) {
-    throw new Error("Farm mode requires browser.viewport to be set (e.g. { width: 1280, height: 720 })");
-  }
-  const bstackBrowser = BROWSER_MAP[browser.name];
-  if (!bstackBrowser) {
-    throw new Error(`Unsupported browser for BrowserStack: "${browser.name}". Supported: ${Object.keys(BROWSER_MAP).join(", ")}`);
-  }
-  return {
-    browser: bstackBrowser,
-    os: "os x",
-    os_version: "sonoma",
-    resolution: "1920x1080",
-    "browserstack.username": credentials.username,
-    "browserstack.accessKey": credentials.accessKey,
-    "client.playwrightVersion": opts?.playwrightVersion ?? detectPlaywrightVersion(),
-    project: "agent-qa",
-    build: "agent-qa-" + Date.now(),
-    name: opts?.testName
-  };
-}
-function mapMobileCapabilities(match, platform, credentials, opts) {
-  if (!opts?.testTimeout) {
-    throw new Error("Farm mode requires timeout.test to be set in config");
-  }
-  return {
-    "bstack:options": {
-      userName: credentials.username,
-      accessKey: credentials.accessKey,
-      deviceName: match.deviceName,
-      osVersion: match.platformVersion,
-      projectName: "agent-qa",
-      buildName: "agent-qa-" + Date.now(),
-      sessionName: opts.testName,
-      idleTimeout: Math.ceil(opts.testTimeout / 1e3)
-    }
-  };
-}
-
-// src/farm/browserstack.ts
-import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
-import { basename as basename2, resolve as resolvePath2 } from "path";
-function isAbsoluteAppValue(value) {
-  return value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
-}
-function isExplicitRelativePath(value) {
-  return value.startsWith("./") || value.startsWith("../");
-}
-async function resolveBrowserStackApp(config) {
-  if (!config.app) return void 0;
-  if (isAbsoluteAppValue(config.app)) {
-    throw new MobileSetupError({
-      category: "app-install",
-      message: `BrowserStack app value must be a BrowserStack reference or relative upload path: ${config.app}`,
-      platform: config.platform,
-      appId: config.app,
-      sourceTrace: config.appSourceTrace
-    });
-  }
-  const appBaseDir = config.appBaseDir ?? process.cwd();
-  const resolvedPath = resolvePath2(appBaseDir, config.app);
-  const mustExist = isExplicitRelativePath(config.app);
-  if (!existsSync5(resolvedPath)) {
-    if (mustExist) {
-      throw new MobileSetupError({
-        category: "app-install",
-        message: `Configured BrowserStack app upload path not found: ${resolvedPath}`,
-        platform: config.platform,
-        appId: config.app,
-        sourceTrace: config.appSourceTrace
-      });
-    }
-    return config.app;
-  }
-  const auth = Buffer.from(`${config.credentials.username}:${config.credentials.accessKey}`).toString("base64");
-  const form = new FormData();
-  form.append("file", new Blob([readFileSync2(resolvedPath)]), basename2(resolvedPath));
-  let res;
-  try {
-    res = await fetch("https://api-cloud.browserstack.com/app-automate/upload", {
-      method: "POST",
-      headers: { Authorization: `Basic ${auth}` },
-      body: form
-    });
-  } catch (err) {
-    throw new MobileSetupError({
-      category: "app-install",
-      message: `Failed to upload BrowserStack app: ${err instanceof Error ? err.message : String(err)}`,
-      platform: config.platform,
-      appId: config.app,
-      sourceTrace: config.appSourceTrace,
-      cause: err
-    });
-  }
-  if (!res.ok) {
-    throw new MobileSetupError({
-      category: "app-install",
-      message: `Failed to upload BrowserStack app: HTTP ${res.status}`,
-      platform: config.platform,
-      appId: config.app,
-      sourceTrace: config.appSourceTrace
-    });
-  }
-  const body = await res.json();
-  if (!body.app_url) {
-    throw new MobileSetupError({
-      category: "app-install",
-      message: "Failed to upload BrowserStack app: response missing app_url",
-      platform: config.platform,
-      appId: config.app,
-      sourceTrace: config.appSourceTrace
-    });
-  }
-  return body.app_url;
-}
-var browserstackProvider = {
-  name: "BrowserStack",
-  slug: "browserstack",
-  async resolveWebEndpoint(config) {
-    const caps = mapWebCapabilities(config.browser, config.credentials, {
-      testName: config.testName,
-      playwrightVersion: config.playwrightVersion
-    });
-    const wsEndpoint = `wss://cdp.browserstack.com/playwright?caps=${encodeURIComponent(JSON.stringify(caps))}`;
-    return { wsEndpoint, capabilities: caps };
-  },
-  async resolveMobileCapabilities(config) {
-    const bstackCaps = mapMobileCapabilities(config.match, config.platform, config.credentials, {
-      testName: config.testName,
-      testTimeout: config.testTimeout
-    });
-    const automationName = config.match.automationName ?? (config.platform === "android" ? "UiAutomator2" : "XCUITest");
-    const platformName = config.platform === "android" ? "Android" : "iOS";
-    const capabilities = {
-      platformName,
-      "appium:automationName": automationName
-    };
-    for (const [key, value] of Object.entries(config.match)) {
-      if (key !== "automationName" && key !== "noReset") {
-        capabilities[`appium:${key}`] = value;
-      }
-    }
-    Object.assign(capabilities, bstackCaps);
-    const browserName = typeof config.match.browserName === "string" ? config.match.browserName.trim() : "";
-    const appStateNoReset = config.appState === "preserve" ? true : config.appState === "reset" ? false : void 0;
-    if (!browserName && appStateNoReset !== void 0) {
-      capabilities["appium:noReset"] = appStateNoReset;
-    }
-    const resolvedAppValue = await resolveBrowserStackApp(config);
-    if (resolvedAppValue) {
-      capabilities["appium:app"] = resolvedAppValue;
-    }
-    return {
-      hostname: "hub.browserstack.com",
-      port: 443,
-      path: "/wd/hub",
-      capabilities
-    };
-  },
-  resolveCredentials(providerConfig) {
-    return resolveFarmCredentials("browserstack", providerConfig);
-  },
-  async validateDevice(deviceName, platform) {
-    let credentials;
-    try {
-      credentials = resolveFarmCredentials("browserstack");
-    } catch {
-      return { valid: false, suggestions: ["Could not validate \u2014 credentials not configured"] };
-    }
-    const auth = Buffer.from(`${credentials.username}:${credentials.accessKey}`).toString("base64");
-    try {
-      const res = await fetch("https://api-cloud.browserstack.com/app-automate/devices.json", {
-        headers: { Authorization: `Basic ${auth}` }
-      });
-      if (!res.ok) {
-        return { valid: false, suggestions: ["Could not validate \u2014 API returned " + res.status] };
-      }
-      const devices = await res.json();
-      const targetOs = platform === "android" ? "android" : "ios";
-      const match = devices.find(
-        (d) => d.device.toLowerCase() === deviceName.toLowerCase() && d.os.toLowerCase() === targetOs
-      );
-      if (match) return { valid: true };
-      const similar = devices.filter((d) => d.os.toLowerCase() === targetOs).filter((d) => d.device.toLowerCase().includes(deviceName.toLowerCase().split(" ")[0])).map((d) => d.device).slice(0, 5);
-      return { valid: false, suggestions: similar.length > 0 ? similar : void 0 };
-    } catch {
-      return { valid: false, suggestions: ["Could not validate \u2014 network error"] };
-    }
-  },
-  getSessionUrl(sessionId, type) {
-    if (type === "web") {
-      return `https://automate.browserstack.com/sessions/${sessionId}`;
-    }
-    return `https://app-automate.browserstack.com/sessions/${sessionId}`;
-  }
-};
-
-// src/farm/registry.ts
-var providers = /* @__PURE__ */ new Map();
-function registerProvider(provider) {
-  providers.set(provider.slug, provider);
-}
-function getProvider(slug) {
-  return providers.get(slug);
-}
-function listProviders() {
-  return Array.from(providers.values());
-}
-function registerAllProviders() {
-  registerProvider(browserstackProvider);
-}
-
 // src/suite/member.ts
 function isPlainObject2(val) {
   return typeof val === "object" && val !== null && !Array.isArray(val);
@@ -3621,7 +3389,7 @@ function patchTestForSuite(test, suite, _index) {
 
 // src/validation/validate.ts
 import { readFile as readFile8 } from "fs/promises";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import path6 from "path";
 import { parse as parseYaml3, LineCounter as LineCounter2, parseDocument } from "yaml";
 import { glob as glob2 } from "glob";
@@ -3670,7 +3438,7 @@ function isPathInsideDir(childPath, parentDir) {
 }
 
 // src/workspace/workspace-paths.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import path5 from "path";
 import { glob } from "glob";
 function toForwardSlash(value) {
@@ -3785,7 +3553,7 @@ function resolveWorkspacePaths(input) {
       ["workspace.envFile", resolved.envFile],
       ["workspace.secretsFile", resolved.secretsFile]
     ]) {
-      if (!existsSync6(file.absolutePath)) {
+      if (!existsSync5(file.absolutePath)) {
         throw new Error(`Configured workspace file not found: ${key} -> ${file.absolutePath}`);
       }
     }
@@ -3816,7 +3584,7 @@ async function resolveWorkspaceFileTarget(input) {
   })) {
     throw new Error(`Workspace ${input.kind} file is not matched by configured workspace patterns: ${workspaceRelativePath}`);
   }
-  if (input.requireExisting && !existsSync6(absolutePath)) {
+  if (input.requireExisting && !existsSync5(absolutePath)) {
     throw new Error(`Workspace ${input.kind} file not found: ${workspaceRelativePath}`);
   }
   return {
@@ -3938,7 +3706,7 @@ function validateSuiteFile(filePath, content, basedir) {
       continue;
     }
     const resolved = path6.resolve(basedir, testPath);
-    if (!existsSync7(resolved)) {
+    if (!existsSync6(resolved)) {
       let line = 1;
       let column = 1;
       const seqNode = testsNode;
@@ -3959,13 +3727,13 @@ function validateSuiteFile(filePath, content, basedir) {
   return diagnostics;
 }
 function validateFilename(filePath) {
-  const basename3 = path6.basename(filePath);
-  if (!VALID_FILENAME_RE.test(basename3)) {
+  const basename2 = path6.basename(filePath);
+  if (!VALID_FILENAME_RE.test(basename2)) {
     return [{
       file: filePath,
       line: 1,
       column: 1,
-      message: `Invalid filename "${basename3}" \u2014 expected pattern: [a-zA-Z0-9._-]+.(suite.)?(yaml|yml)`,
+      message: `Invalid filename "${basename2}" \u2014 expected pattern: [a-zA-Z0-9._-]+.(suite.)?(yaml|yml)`,
       severity: "warning"
     }];
   }
@@ -3973,7 +3741,7 @@ function validateFilename(filePath) {
 }
 async function validateHooksFile(hooksFilePath, options = {}) {
   const diagnostics = [];
-  if (!existsSync7(hooksFilePath)) {
+  if (!existsSync6(hooksFilePath)) {
     if (options.required) {
       return [buildDiagnostic(hooksFilePath, `Configured hooks file not found: ${hooksFilePath}`)];
     }
@@ -3993,7 +3761,7 @@ async function validateHooksFile(hooksFilePath, options = {}) {
     return diagnostics;
   }
   for (const hook of hooks) {
-    if (!existsSync7(hook.file)) {
+    if (!existsSync6(hook.file)) {
       diagnostics.push({
         file: hooksFilePath,
         line: 1,
@@ -4003,7 +3771,7 @@ async function validateHooksFile(hooksFilePath, options = {}) {
       });
     }
     for (const dep of hook.deps) {
-      if (!existsSync7(dep)) {
+      if (!existsSync6(dep)) {
         diagnostics.push({
           file: hooksFilePath,
           line: 1,
@@ -4013,7 +3781,7 @@ async function validateHooksFile(hooksFilePath, options = {}) {
         });
       }
     }
-    if (hook.packageFile && !existsSync7(hook.packageFile)) {
+    if (hook.packageFile && !existsSync6(hook.packageFile)) {
       diagnostics.push({
         file: hooksFilePath,
         line: 1,
@@ -4127,7 +3895,7 @@ function validateRequiredWorkspaceFiles(workspace) {
     ["workspace.envFile", workspace.envFile],
     ["workspace.secretsFile", workspace.secretsFile]
   ]) {
-    if (!existsSync7(file.absolutePath)) {
+    if (!existsSync6(file.absolutePath)) {
       diagnostics.push(buildDiagnostic(file.absolutePath, `Configured workspace file not found: ${key} -> ${file.absolutePath}`));
     }
   }
@@ -4188,7 +3956,7 @@ async function validateProject(options = {}) {
     if (d.severity === "error") result.errorCount++;
     else result.warningCount++;
   }
-  if (hooksFilePath && hooksDiags.length === 0 && existsSync7(hooksFilePath)) {
+  if (hooksFilePath && hooksDiags.length === 0 && existsSync6(hooksFilePath)) {
     const { hooks } = await parseHooksFile(hooksFilePath);
     const hookIds = new Set(hooks.map((h) => h.id));
     for (const filePath of filePaths) {
@@ -4293,7 +4061,7 @@ function warnIfOutOfBounds(coords, viewport, actionType) {
 }
 
 // src/hooks/index.ts
-import { RUNTIME_IMAGE_MAP } from "@vostride/agent-qa-runner";
+import { RUNTIME_IMAGE_MAP, hookRunnerImage } from "@vostride/agent-qa-runner";
 
 // src/ids/hook-id.ts
 import { generateHookId as generateSharedHookId } from "@vostride/agent-qa-ids";
@@ -4317,8 +4085,6 @@ var ATTR_RUNNER = "agent-qa.runner";
 var ATTR_GATE_RUN = "agent-qa.gate-run";
 var RUN_ATTRIBUTE_KEY_MAX_LENGTH = 256;
 var RUN_ATTRIBUTE_VALUE_MAX_LENGTH = 4096;
-var RUN_ATTRIBUTE_TRIGGERS = ["cli", "dashboard", "api", "mcp"];
-var RUN_ATTRIBUTE_RUNNERS = ["local", "browserstack"];
 function isPlainRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4333,43 +4099,6 @@ function assertValidUserAttributeKey(key, sourceLabel) {
     throw new Error(`${sourceLabel}: Attribute key "${key}" exceeds ${RUN_ATTRIBUTE_KEY_MAX_LENGTH} characters`);
   }
 }
-function assertValidAttributeKeyShape(key, sourceLabel) {
-  if (key.length === 0) {
-    throw new Error(`${sourceLabel}: Attribute key must be non-empty`);
-  }
-  if (key.length > RUN_ATTRIBUTE_KEY_MAX_LENGTH) {
-    throw new Error(`${sourceLabel}: Attribute key "${key}" exceeds ${RUN_ATTRIBUTE_KEY_MAX_LENGTH} characters`);
-  }
-}
-function assertValidAttributeValue(key, value, sourceLabel) {
-  if (typeof value !== "string") {
-    throw new Error(`${sourceLabel}: Attribute value for "${key}" must be a string`);
-  }
-  if (value.length > RUN_ATTRIBUTE_VALUE_MAX_LENGTH) {
-    throw new Error(`${sourceLabel}: Attribute value for "${key}" exceeds ${RUN_ATTRIBUTE_VALUE_MAX_LENGTH} characters`);
-  }
-}
-function assertValidInternalAttribute(key, value, sourceLabel) {
-  if (key === ATTR_TRIGGER) {
-    if (!RUN_ATTRIBUTE_TRIGGERS.includes(value)) {
-      throw new Error(`${sourceLabel}: Attribute value for "${key}" must be one of: ${RUN_ATTRIBUTE_TRIGGERS.join(", ")}`);
-    }
-    return;
-  }
-  if (key === ATTR_RUNNER) {
-    if (!RUN_ATTRIBUTE_RUNNERS.includes(value)) {
-      throw new Error(`${sourceLabel}: Attribute value for "${key}" must be one of: ${RUN_ATTRIBUTE_RUNNERS.join(", ")}`);
-    }
-    return;
-  }
-  if (key === ATTR_GATE_RUN) {
-    if (value !== "true") {
-      throw new Error(`${sourceLabel}: Attribute value for "${key}" must be "true"`);
-    }
-    return;
-  }
-  throw new Error(`${sourceLabel}: Attribute key "${key}" uses the reserved prefix "${INTERNAL_ATTRIBUTE_PREFIX}"`);
-}
 function validateUserRunAttributes(input, sourceLabel = "run attributes") {
   if (input === void 0 || input === null) return {};
   if (!isPlainRecord(input)) {
@@ -4388,22 +4117,6 @@ function validateUserRunAttributes(input, sourceLabel = "run attributes") {
   }
   return attributes;
 }
-function validateTrustedRunAttributes(input, sourceLabel = "run attributes") {
-  if (input === void 0 || input === null) return {};
-  if (!isPlainRecord(input)) {
-    throw new Error(`${sourceLabel}: attributes must be a plain object`);
-  }
-  const attributes = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(input)) {
-    assertValidAttributeKeyShape(key, sourceLabel);
-    assertValidAttributeValue(key, value, sourceLabel);
-    if (key.startsWith(INTERNAL_ATTRIBUTE_PREFIX)) {
-      assertValidInternalAttribute(key, value, sourceLabel);
-    }
-    attributes[key] = value;
-  }
-  return attributes;
-}
 function parseRunAttrFlags(flags) {
   const rawAttributes = /* @__PURE__ */ Object.create(null);
   const seen = /* @__PURE__ */ new Set();
@@ -4463,8 +4176,8 @@ function formatRunAttributesBlock(attributes) {
 }
 
 // src/version.ts
-import { createRequire as createRequire3 } from "module";
-var require2 = createRequire3(typeof __filename === "string" ? __filename : import.meta.url);
+import { createRequire as createRequire2 } from "module";
+var require2 = createRequire2(typeof __filename === "string" ? __filename : import.meta.url);
 function readPackageVersion() {
   try {
     const manifest = require2("../package.json");
@@ -4482,10 +4195,10 @@ function getAgentQaVersion() {
 
 // src/version-check/index.ts
 import { chmod, mkdir as mkdir3, readFile as readFile9, writeFile as writeFile3 } from "fs/promises";
-import { createRequire as createRequire4 } from "module";
+import { createRequire as createRequire3 } from "module";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname7, join as join3 } from "path";
-var require3 = createRequire4(typeof __filename === "string" ? __filename : import.meta.url);
+var require3 = createRequire3(typeof __filename === "string" ? __filename : import.meta.url);
 var AGENT_QA_NPM_REGISTRY_URL = "https://registry.npmjs.org/agent-qa";
 var VERSION_CHECK_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var VERSION_CHECK_TIMEOUT_MS = 5e3;
@@ -4670,7 +4383,6 @@ export {
   AUTH_STATE_SCHEMA_VERSION,
   AUTH_STATE_SLUG_PATTERN,
   AccessibilityConfigSchema,
-  ActionPlanSchema,
   AdapterLogDataSchema,
   AgentLogDataSchema,
   AgentQaConfigSchema,
@@ -4727,7 +4439,6 @@ export {
   PlannerConfigSchema,
   PlannerLogDataSchema,
   PluginsSchema,
-  ProviderConfigSchema,
   ProviderPluginDeclarationSchema,
   RUNTIME_IMAGE_MAP,
   RUN_ATTRIBUTE_KEY_MAX_LENGTH,
@@ -4745,7 +4456,6 @@ export {
   TestMetaSchema,
   TestStepSchema,
   TimeoutConfigSchema,
-  TransportSchema,
   UseSchema,
   VALID_FILENAME_RE,
   VERSION_CHECK_CACHE_TTL_MS,
@@ -4753,7 +4463,6 @@ export {
   WEBVIEW_SCROLLERS_SCRIPT,
   WorkspaceSchema,
   applyPatchSetToTestDoc,
-  browserstackProvider,
   buildAuthStateHookEnv,
   buildInternalRunAttributes,
   buildRefEntries,
@@ -4766,7 +4475,6 @@ export {
   createAuthFetch,
   deriveMobileScroll,
   detectGlobOverlap,
-  detectPlaywrightVersion,
   discoverWorkspaceFiles,
   estimateTokens,
   formatAppiumInstallGuidance,
@@ -4785,21 +4493,21 @@ export {
   getAuthPath,
   getCredential,
   getLLMAuthProviderPlugin,
-  getProvider,
+  guardJsonText,
+  guardRunText,
+  hookRunnerImage,
   isCanonicalRunId,
+  isGitHubActions,
   isLoopbackHost,
   isPathInsideDir,
   isReservedAuthStateHookEnvKey,
   isWorkspacePathMatch,
   listAuthStateMetadata,
   listLLMAuthProviderPlugins,
-  listProviders,
   loadLLMAuthPlugins,
   loadProviderPlugins,
   localAppiumBinaryNames,
   locateRunsDbPath,
-  mapMobileCapabilities,
-  mapWebCapabilities,
   mergeRunAttributes,
   normalizeAuthStateUse,
   normalizeRole,
@@ -4814,21 +4522,21 @@ export {
   parseTestFileWithTokens,
   parseWebViewScrollers,
   patchTestForSuite,
+  printRunText,
   readAuth,
   readAuthStateMetadata,
-  registerAllProviders,
+  refuseRetiredLocalBindings,
   registerLLMAuthProviderPlugin,
   registerLLMAuthProviderPlugins,
-  registerProvider,
   removeAuth,
   removeAuthStateFiles,
   removeAuthStateTarget,
   renderPatchedTestDoc,
+  reserveStdoutForData,
   resolveAppiumExecutable,
   resolveAuthStateForRun,
   resolveAuthStatePaths,
   resolveAuthStateRoot,
-  resolveFarmCredentials,
   resolveFileReferences,
   resolveKnowledgeRoot,
   resolveLLMAuth,
@@ -4844,7 +4552,6 @@ export {
   validateProject,
   validateSuiteFile,
   validateTestFile,
-  validateTrustedRunAttributes,
   validateUserRunAttributes,
   warnIfOutOfBounds,
   webViewSwipeSignal,