agent-qa 0.1.13 → 0.1.15

package/dist/cli.cjs

@@ -355,7 +355,7 @@ __export(cli_exports, {
   program: () => program
 });
 module.exports = __toCommonJS(cli_exports);
-var import_commander19 = require("commander");
+var import_commander20 = require("commander");
 
 // src/index.ts
 var index_exports = {};
@@ -520,6 +520,7 @@ var import_agent_qa_core4 = require("@vostride/agent-qa-core");
 init_model_defaults();
 var import_meta = {};
 var INIT_CACHE_DIR = import_agent_qa_core4.DEFAULT_AGENT_QA_CACHE_DIR || ".agent-qa/cache";
+var INIT_AUTH_STATES_DIR = import_agent_qa_core4.DEFAULT_AGENT_QA_AUTH_STATES_DIR || ".agent-qa/auth-states";
 var INIT_RUNTIME_DIR = import_agent_qa_core4.DEFAULT_AGENT_QA_RUNTIME_DIR || ".agent-qa";
 var SUBSCRIPTION_AUTH_PACKAGE = "@vostride/agent-qa-subscription-auth";
 var PACKAGE_JSON_FILE = "package.json";
@@ -852,6 +853,7 @@ function buildDefaultConfig(platform, providerOrLLMs, model, baseURL) {
       dashboard: { port: 3100, artifactsDir: ".agent-qa/artifacts" },
       mcp: { enabled: true, transport: "http", host: "127.0.0.1", port: 3471, path: "/mcp" },
       cache: { dir: INIT_CACHE_DIR, ttl: "7d" },
+      authState: { dir: INIT_AUTH_STATES_DIR },
       ...hasWeb(platform) ? {
         accessibility: {
           enabled: true,
@@ -893,7 +895,7 @@ function addYamlComments(yamlStr) {
     if (line.startsWith("workspace:")) {
       result += "# File discovery and project settings\n";
     } else if (line.startsWith("services:")) {
-      result += "\n# Infrastructure services (dashboard, MCP, cache, logging)\n";
+      result += "\n# Infrastructure services (dashboard, MCP, cache, auth state, logging)\n";
     } else if (line.startsWith("registry:")) {
       result += "\n# Named resource definitions (LLM configs, app targets)\n";
     } else if (line.startsWith("plugins:")) {
@@ -948,7 +950,19 @@ var DEFAULT_AGENT_RULES_FILE = "agent-rules.md";
 var DEFAULT_ENV_FILE = ".env";
 var DEFAULT_SECRETS_FILE = ".env.secrets.local";
 var DEFAULT_LOCAL_CONFIG_FILE = "agent-qa.local.yaml";
-var GITIGNORE_ENTRIES = [`${INIT_RUNTIME_DIR}/`, "node_modules/", DEFAULT_LOCAL_CONFIG_FILE, DEFAULT_ENV_FILE, DEFAULT_SECRETS_FILE];
+function directoryGitignoreEntry(value) {
+  return value.endsWith("/") ? value : `${value}/`;
+}
+function buildGitignoreEntries() {
+  return [
+    directoryGitignoreEntry(INIT_RUNTIME_DIR),
+    directoryGitignoreEntry(INIT_AUTH_STATES_DIR),
+    "node_modules/",
+    DEFAULT_LOCAL_CONFIG_FILE,
+    DEFAULT_ENV_FILE,
+    DEFAULT_SECRETS_FILE
+  ];
+}
 function buildLocalConfigTemplate() {
   return `# This file is for machine-specific device, app, and provider bindings.
 # Keep it out of git.
@@ -977,7 +991,10 @@ function appendGitignore(dir) {
   if ((0, import_node_fs.existsSync)(gitignorePath)) {
     existing = (0, import_node_fs.readFileSync)(gitignorePath, "utf-8");
   }
-  const missing = GITIGNORE_ENTRIES.filter((entry) => !existing.includes(entry));
+  const existingEntries = new Set(
+    existing.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
+  );
+  const missing = buildGitignoreEntries().filter((entry) => !existingEntries.has(entry));
   if (missing.length === 0) return;
   const append = (existing.length > 0 && !existing.endsWith("\n") ? "\n" : "") + missing.join("\n") + "\n";
   (0, import_node_fs.writeFileSync)(gitignorePath, existing + append);
@@ -2588,7 +2605,7 @@ async function loadRuntimeSecrets(input3) {
   }
 }
 function buildRunArtifactContext(input3) {
-  return {
+  return (0, import_agent_qa_core7.redactAuthStateValue)({
     artifact: {
       kind: input3.kind,
       config: {
@@ -2622,7 +2639,7 @@ function buildRunArtifactContext(input3) {
         attributes: input3.attributes
       }
     }
-  };
+  });
 }
 async function resolveDeviceAndFarmSession(config, deviceName, testPlatform, testName, testTimeout, preResolvedDevice, localBindingsOverride, mobileResolved) {
   if (!deviceName || testPlatform === "web") return {};
@@ -2700,6 +2717,82 @@ function resolveMobileRunOrThrow(input3) {
     wrapMobileSetupError(err);
   }
 }
+function getSelectedAuthStateUse(use) {
+  return (0, import_agent_qa_core7.normalizeAuthStateUse)(use);
+}
+async function resolveSelectedAuthStateForRun(input3) {
+  if (!input3.authState || input3.authState.load === false) return void 0;
+  try {
+    return await (0, import_agent_qa_core7.resolveAuthStateForRun)({
+      configDir: input3.configDir,
+      authStateDir: input3.config.services?.authState?.dir,
+      targetName: input3.resolvedTarget.name,
+      stateName: input3.authState.name,
+      target: { platform: input3.resolvedTarget.platform }
+    });
+  } catch (err) {
+    console.error(import_picocolors7.default.red(`Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(2);
+  }
+}
+function resolveAuthStateCapturePathsForRun(input3) {
+  if (input3.authState?.capture !== true) return void 0;
+  try {
+    return (0, import_agent_qa_core7.resolveAuthStatePaths)({
+      configDir: input3.configDir,
+      authStateDir: input3.config.services?.authState?.dir,
+      targetName: input3.resolvedTarget.name,
+      stateName: input3.authState.name,
+      target: { platform: input3.resolvedTarget.platform }
+    });
+  } catch (err) {
+    console.error(import_picocolors7.default.red(`Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(2);
+  }
+}
+function formatAuthStateCaptureFailure(paths) {
+  return `Could not save auth state "${paths.stateName}" for target "${paths.targetName}".`;
+}
+function getStorageStateContext(adapter) {
+  const maybeGetPage = adapter.getPage;
+  if (typeof maybeGetPage !== "function") return null;
+  const page = maybeGetPage.call(adapter);
+  if (!page || typeof page !== "object") return null;
+  const maybeContext = page.context;
+  if (typeof maybeContext !== "function") return null;
+  const context = maybeContext.call(page);
+  if (!context || typeof context !== "object") return null;
+  const storageState = context.storageState;
+  if (typeof storageState !== "function") return null;
+  return {
+    storageState: storageState.bind(context)
+  };
+}
+async function captureAuthStateForRun(input3) {
+  const context = getStorageStateContext(input3.adapter);
+  if (!context) {
+    throw new Error("Web auth-state capture requires a Playwright browser context.");
+  }
+  const payload = await context.storageState({ indexedDB: true });
+  const capturedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const metadata = {
+    version: import_agent_qa_core7.AUTH_STATE_SCHEMA_VERSION,
+    kind: "web",
+    target: input3.paths.targetName,
+    name: input3.paths.stateName,
+    capturedAt
+  };
+  const { writeAuthStateFiles: writeAuthStateFiles2 } = await import("@vostride/agent-qa-core");
+  await writeAuthStateFiles2(input3.paths, { payload, metadata });
+  return {
+    version: metadata.version,
+    kind: metadata.kind,
+    targetName: metadata.target,
+    stateName: metadata.name,
+    capturedAt: metadata.capturedAt,
+    storageStatePath: input3.paths.payloadPath
+  };
+}
 async function executeSuites(suiteFiles, opts, config, globalOpts, configContent, effectiveLogLevel, variableContext, hooksContext) {
   const {
     parseSuiteFile: parseSuiteFile2,
@@ -2800,6 +2893,13 @@ async function executeSuites(suiteFiles, opts, config, globalOpts, configContent
       suiteFileContent = await readFile5(suiteFile, "utf-8");
     } catch {
     }
+    const mergedUse = mergeUseBlocks(
+      config.use,
+      suite.use,
+      void 0,
+      {}
+    );
+    const suiteAuthStateUse = getSelectedAuthStateUse(mergedUse);
     const testEntries = [];
     const suiteMembers = [];
     for (const { test: relativePath, id: suiteEntryId } of suite.tests) {
@@ -2919,6 +3019,11 @@ async function executeSuites(suiteFiles, opts, config, globalOpts, configContent
         process.exit(2);
       }
       const testDef = parseResult.tests[0];
+      const childAuthStateUse = getSelectedAuthStateUse(testDef.use);
+      if (suiteAuthStateUse && childAuthStateUse && childAuthStateUse.name !== suiteAuthStateUse.name) {
+        console.error(import_picocolors7.default.red(`Suite auth state "${suiteAuthStateUse.name}" conflicts with child test auth state "${childAuthStateUse.name}". Use one primary auth state per suite.`));
+        process.exit(2);
+      }
       if (testDef["test-id"] && testDef["test-id"] !== suiteEntryId) {
         const mismatchMsg = `ID mismatch in suite "${suite.name}": test file ${relativePath} has test-id "${testDef["test-id"]}" but suite entry specifies id "${suiteEntryId}"`;
         console.error(import_picocolors7.default.red(mismatchMsg));
@@ -2970,12 +3075,18 @@ async function executeSuites(suiteFiles, opts, config, globalOpts, configContent
     }
     const suiteResolvedTarget = suite.target ? resolveTarget(config, suite.target) : resolveTarget(config, testEntries[0][0].target);
     const suitePlatform = suiteResolvedTarget.platform;
-    const mergedUse = mergeUseBlocks(
-      config.use,
-      suite.use,
-      void 0,
-      {}
-    );
+    const suiteAuthState = await resolveSelectedAuthStateForRun({
+      config,
+      configDir,
+      resolvedTarget: suiteResolvedTarget,
+      authState: suiteAuthStateUse
+    });
+    const suiteAuthStateCapturePaths = resolveAuthStateCapturePathsForRun({
+      config,
+      configDir,
+      resolvedTarget: suiteResolvedTarget,
+      authState: suiteAuthStateUse
+    });
     const suiteEffectiveCacheEnabled = opts.cache !== false && mergedUse.cache !== false;
     let suiteDeviceName = opts.device ?? mergedUse.device;
     if ((suitePlatform === "android" || suitePlatform === "ios") && !suiteDeviceName) {
@@ -3059,6 +3170,7 @@ async function executeSuites(suiteFiles, opts, config, globalOpts, configContent
     const suiteBrowser = mergedUse.browser ?? config.use?.browser;
     const suiteLogCapture = mergedUse.logCapture ?? config.use?.logCapture;
     const platformConfig = buildPlatformConfig(suitePlatform, resolvedDevice, testTimeouts, suiteBrowser, suiteLogCapture, farmSession, mobileResolved);
+    platformConfig.authState = suiteAuthState;
     platformConfig.verbose = effectiveLogLevel === "debug";
     if (opts.headless !== void 0 && platformConfig.browser) {
       platformConfig.browser.headless = opts.headless;
@@ -3249,6 +3361,10 @@ async function executeSuites(suiteFiles, opts, config, globalOpts, configContent
       memoryRoot: suiteMemoryRoot,
       circuitBreaker: suiteCircuitBreaker,
       product: resolvedTarget?.product,
+      authStateCapture: suiteAuthStateCapturePaths ? {
+        capture: () => captureAuthStateForRun({ adapter, paths: suiteAuthStateCapturePaths }),
+        failureSummary: formatAuthStateCaptureFailure(suiteAuthStateCapturePaths)
+      } : void 0,
       createAdapter: () => createPlatformAdapter(suitePlatform),
       resolveUrl: (targetName) => {
         try {
@@ -3578,7 +3694,7 @@ Discovered ${files.length} test file(s):
           dashboardDb.insertRunArtifact({
             runId: artifactRunId,
             kind: "test",
-            payload: {
+            payload: (0, import_agent_qa_core7.redactAuthStateValue)({
               config: {
                 rawConfigContent: configContent,
                 parsedConfig: config,
@@ -3609,7 +3725,7 @@ Discovered ${files.length} test file(s):
                 message: error.message,
                 details: error
               }))
-            }
+            })
           });
           dashboardDb.finalizeRunArtifact(artifactRunId);
           dashboardDb.close();
@@ -3781,6 +3897,20 @@ Config for: ${test.name}`));
             }
             const testPlatform = testResolvedTarget.platform;
             analyticsPlatform = testPlatform;
+            const testAuthStateUse = getSelectedAuthStateUse(mergedUse);
+            const testAuthState = await resolveSelectedAuthStateForRun({
+              config,
+              configDir,
+              resolvedTarget: testResolvedTarget,
+              authState: testAuthStateUse
+            });
+            const testAuthStateCapturePaths = resolveAuthStateCapturePathsForRun({
+              config,
+              configDir,
+              resolvedTarget: testResolvedTarget,
+              authState: testAuthStateUse
+            });
+            let activeTestAuthState = testAuthState;
             const testMergedUse = testMergedConfig.use ?? config.use ?? {};
             const testDeviceName = opts.device ?? testMergedUse.device;
             const testTimeoutsForSetup = {
@@ -3860,6 +3990,7 @@ Config for: ${test.name}`));
               adapter = await createPlatformAdapter(testPlatform);
               const mergedBrowser = mergedUse.browser;
               const platformConfig = buildPlatformConfig(testPlatform, testResolvedDevice, testTimeoutsForSetup, mergedBrowser ?? config.use?.browser, testMergedConfig.use?.logCapture ?? config.use?.logCapture, testFarmSession, testMobileResolved);
+              platformConfig.authState = activeTestAuthState;
               platformConfig.verbose = effectiveLogLevel === "debug";
               if (opts.headless !== void 0) {
                 if (platformConfig.browser) {
@@ -3978,10 +4109,12 @@ Config for: ${test.name}`));
               runId,
               artifact: artifactContext.artifact
             });
+            const getAuthAwareSandboxOptions = () => sandboxOptions && activeTestAuthState ? { ...sandboxOptions, authState: activeTestAuthState } : sandboxOptions;
+            const authAwareSandboxOptions = getAuthAwareSandboxOptions();
             let perTestSetupVars = {};
             let testStartTime = Date.now();
             let setupHookFailed = false;
-            if (resolvedHooks && sandboxOptions && testDef.setup?.length) {
+            if (resolvedHooks && authAwareSandboxOptions && testDef.setup?.length) {
               const { runHooks } = await import("@vostride/agent-qa-core");
               const hookDefs = [];
               let hookSetupError;
@@ -4001,7 +4134,7 @@ Config for: ${test.name}`));
                 for (const hookDef of hookDefs) {
                   const hookExecId = (0, import_node_crypto.randomUUID)();
                   await multiReporter.onHookStart({ hookId: hookDef.id, hookName: hookDef.name, phase: "setup", hookExecutionId: hookExecId, runId });
-                  const hookResult = await runHooks([hookDef], { ...sandboxOptions, envVars: { ...sandboxOptions.envVars, ...allVars, ...perTestSetupVars } });
+                  const hookResult = await runHooks([hookDef], { ...authAwareSandboxOptions, envVars: { ...authAwareSandboxOptions.envVars, ...allVars, ...perTestSetupVars } });
                   const hr = hookResult.results.get(hookDef.name);
                   await multiReporter.onHookEnd({
                     hookId: hookDef.id,
@@ -4088,7 +4221,7 @@ Config for: ${test.name}`));
               cliVars,
               hookSetupVars: perTestSetupVars,
               inlineHookDefs: resolvedHooks,
-              inlineHookSandboxOptions: sandboxOptions,
+              inlineHookSandboxOptions: authAwareSandboxOptions,
               logCapture: testLogCapture,
               accessibility: config.services?.accessibility,
               accessibilityCheck: runWebAccessibilityCheck,
@@ -4099,11 +4232,28 @@ Config for: ${test.name}`));
               memoryInitParams,
               circuitBreaker,
               runId,
-              skipReporterOnTestStart: true
+              skipReporterOnTestStart: true,
+              skipReporterOnTestEnd: testAuthStateUse?.capture === true
             }, filePath);
             if (!result.runId) result.runId = runId;
             completedResult = result;
-            if (resolvedHooks && sandboxOptions && testDef.teardown?.length) {
+            if (testAuthStateCapturePaths && result.status === "passed") {
+              try {
+                activeTestAuthState = await captureAuthStateForRun({
+                  adapter,
+                  paths: testAuthStateCapturePaths
+                });
+              } catch {
+                result.status = "failed";
+                result.failureSummary = formatAuthStateCaptureFailure(testAuthStateCapturePaths);
+                result.metadata = {
+                  ...result.metadata,
+                  phase: "auth-state-capture"
+                };
+              }
+            }
+            const teardownSandboxOptions = getAuthAwareSandboxOptions();
+            if (resolvedHooks && teardownSandboxOptions && testDef.teardown?.length) {
               const { runHooks } = await import("@vostride/agent-qa-core");
               for (const hookId of testDef.teardown) {
                 const hook = resolvedHooks.get(hookId);
@@ -4113,7 +4263,7 @@ Config for: ${test.name}`));
                   await multiReporter.onHookStart({ hookId: hook.id, hookName: hook.name, phase: "teardown", hookExecutionId: hookExecId, runId });
                   const allVars = { ...envFileVars, ...perTestSetupVars };
                   if (cliVars) Object.assign(allVars, cliVars);
-                  const hookResult = await runHooks([hook], { ...sandboxOptions, envVars: { ...sandboxOptions.envVars, ...allVars } });
+                  const hookResult = await runHooks([hook], { ...teardownSandboxOptions, envVars: { ...teardownSandboxOptions.envVars, ...allVars } });
                   const hr = hookResult.results.get(hook.name);
                   await multiReporter.onHookEnd({
                     hookId: hook.id,
@@ -4152,7 +4302,8 @@ Config for: ${test.name}`));
               };
             }
             let ablationHandledDeprecation = false;
-            if (memoryProvider && memoryConfig?.ablationEnabled !== false && result.status === "failed") {
+            const authStateCaptureFailed = result.metadata?.phase === "auth-state-capture";
+            if (memoryProvider && memoryConfig?.ablationEnabled !== false && result.status === "failed" && !authStateCaptureFailed) {
               try {
                 const { shouldAblate, collectAllInjectedIds, deprecateOnFailure } = await import("@vostride/agent-qa-core");
                 if (shouldAblate(result, memoryProvider)) {
@@ -4160,6 +4311,7 @@ Config for: ${test.name}`));
                   const ablationAdapter = await createPlatformAdapter(testPlatform);
                   const mergedBrowser = mergedUse.browser;
                   const ablationPlatformConfig = buildPlatformConfig(testPlatform, testResolvedDevice, testTimeoutsForSetup, mergedBrowser ?? config.use?.browser, testMergedConfig.use?.logCapture ?? config.use?.logCapture, testFarmSession, testMobileResolved);
+                  ablationPlatformConfig.authState = activeTestAuthState;
                   ablationPlatformConfig.verbose = effectiveLogLevel === "debug";
                   if (opts.headless !== void 0 && ablationPlatformConfig.browser) {
                     ablationPlatformConfig.browser.headless = opts.headless;
@@ -4191,7 +4343,7 @@ Config for: ${test.name}`));
                       cliVars,
                       hookSetupVars: perTestSetupVars,
                       inlineHookDefs: resolvedHooks,
-                      inlineHookSandboxOptions: sandboxOptions,
+                      inlineHookSandboxOptions: authAwareSandboxOptions,
                       logCapture: testLogCapture,
                       accessibility: config.services?.accessibility,
                       accessibilityCheck: runWebAccessibilityCheck,
@@ -4258,6 +4410,9 @@ Config for: ${test.name}`));
                 console.warn(`  ${import_picocolors7.default.dim("Memory:")} curator error -- ${err.message}`);
               }
             }
+            if (testAuthStateUse?.capture === true) {
+              await multiReporter.onTestEnd(result);
+            }
             results.push(result);
             printRunAttributes(testAttributes);
             if (circuitBreaker && memoryProvider) {
@@ -4268,7 +4423,7 @@ Config for: ${test.name}`));
               circuitBreakerTripped = true;
               console.log(`  ${import_picocolors7.default.yellow("Memory: circuit breaker tripped -- disabling memory injection for remaining tests")}`);
             }
-            if (result.status === "failed" && actionCache && effectiveCacheEnabled && result.steps.length > 0) {
+            if (result.status === "failed" && !authStateCaptureFailed && actionCache && effectiveCacheEnabled && result.steps.length > 0) {
               const { hashStepInstruction: hashStepInstruction2 } = await import("@vostride/agent-qa-core");
               const { rm: rm3 } = await import("fs/promises");
               const { resolve: resolve9, join: join8 } = await import("path");
@@ -4399,7 +4554,7 @@ ${errStack}`;
               status: finalStatus,
               duration: run.startedAt ? Date.now() - new Date(run.startedAt).getTime() : 0,
               endedAt: (/* @__PURE__ */ new Date()).toISOString(),
-              failureSummary: isBrowserClose ? "Browser closed by user" : formattedError.failureSummary
+              failureSummary: isBrowserClose ? "Browser closed by user" : (0, import_agent_qa_core7.redactAuthStateValue)(formattedError.failureSummary)
             });
             try {
               const artifact = _crashDb.getRunArtifact(run.id);
@@ -4412,7 +4567,7 @@ ${errStack}`;
                   errors: [{
                     code: isBrowserClose ? "browser-disconnect" : "process-close",
                     phase: "process-close",
-                    message: isBrowserClose ? "Browser closed by user" : formattedError.failureSummary
+                    message: isBrowserClose ? "Browser closed by user" : (0, import_agent_qa_core7.redactAuthStateValue)(formattedError.failureSummary)
                   }]
                 });
               }
@@ -4569,7 +4724,8 @@ function createMcpCommand() {
       }
       const { startMcpServer } = await import("@vostride/agent-qa-mcp");
       try {
-        await startMcpServer({ analyticsConfig: config });
+        const startupOptions = { analyticsConfig: config, startupOutput: process.stderr };
+        await startMcpServer(startupOptions);
       } finally {
         await (0, import_agent_qa_core11.flushAnalytics)(config ? { config } : void 0).catch(() => {
         });
@@ -5207,37 +5363,259 @@ function createAuthCommand() {
   return cmd;
 }
 
-// src/commands/devices.ts
+// src/commands/auth-state.ts
+var import_promises4 = require("readline/promises");
+var import_node_path11 = require("path");
 var import_commander13 = require("commander");
+var import_picocolors13 = __toESM(require("picocolors"), 1);
+var import_agent_qa_core13 = require("@vostride/agent-qa-core");
+init_config();
+function getGlobalConfigPath3(command) {
+  return command.parent?.parent?.opts().config ?? command.parent?.opts().config;
+}
+function isBrowserName(value) {
+  return value === "chromium" || value === "firefox" || value === "webkit";
+}
+function resolveBrowserName(config) {
+  const name = config.use?.browser?.name;
+  return isBrowserName(name) ? name : "chromium";
+}
+async function loadPlaywrightLaunchers() {
+  const { chromium, firefox, webkit } = await import("playwright-core");
+  return { chromium, firefox, webkit };
+}
+async function waitForCaptureConfirmation(input3) {
+  console.log(input3.message);
+  const rl = (0, import_promises4.createInterface)({ input: process.stdin, output: process.stdout });
+  return await new Promise((resolve9) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      process.off("SIGINT", onSigint);
+      input3.browser.off?.("disconnected", onDisconnected);
+      rl.close();
+      resolve9(result);
+    };
+    const onSigint = () => finish("cancelled");
+    const onDisconnected = () => finish("browser-closed");
+    process.once("SIGINT", onSigint);
+    input3.browser.on("disconnected", onDisconnected);
+    rl.question("").then(() => finish("confirmed")).catch(() => finish("cancelled"));
+  });
+}
+async function authStateExists(paths) {
+  try {
+    await (0, import_agent_qa_core13.readAuthStateMetadata)(paths);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function buildConfirmationMessage(targetName, stateName, exists) {
+  const replace = exists ? " Existing auth state will be replaced." : "";
+  return `Log in in the opened browser, then press Enter to save auth state "${stateName}" for target "${targetName}".${replace} Press Ctrl+C to cancel.`;
+}
+async function loadCommandContext(command) {
+  const configPath = getGlobalConfigPath3(command) ?? "agent-qa.config.yaml";
+  const configDir = (0, import_node_path11.dirname)((0, import_node_path11.resolve)(configPath));
+  const config = await resolveConfig({ configPath, loadAuthPlugins: false });
+  return { configPath, configDir, config };
+}
+function isSafeAuthStateError(message) {
+  return message.includes("auth state is only supported for web targets") || message.includes("use.mobile.appState: preserve") || message.includes("Auth state name must match") || message.includes("Target name must match");
+}
+function printSafeAuthStateError(error, fallback) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(import_picocolors13.default.red(isSafeAuthStateError(message) ? message : fallback));
+}
+function assertWebAuthStateTarget(input3) {
+  (0, import_agent_qa_core13.resolveAuthStatePaths)({
+    configDir: input3.configDir,
+    authStateDir: input3.config.services?.authState?.dir,
+    targetName: input3.target.name,
+    stateName: "placeholder",
+    target: { platform: input3.target.platform }
+  });
+}
+function printAuthStateList(metadata, targetName) {
+  if (metadata.length === 0) {
+    console.log(targetName ? `No auth states saved for target "${targetName}".` : "No auth states saved.");
+    return;
+  }
+  console.log("Target	Name	Captured	Kind");
+  for (const entry of metadata) {
+    console.log(`${entry.target}	${entry.name}	${entry.capturedAt}	${entry.kind}`);
+  }
+}
+async function closeBrowser(browser) {
+  if (!browser) return;
+  try {
+    await browser.close();
+  } catch {
+  }
+}
+function createAuthStateCommand(deps = {}) {
+  const cmd = new import_commander13.Command("auth-state").description("Manage product auth state");
+  cmd.addCommand(
+    new import_commander13.Command("list").description("List saved auth states").option("--target <target>", "target name from agent-qa config").action(async (opts, command) => {
+      try {
+        const { configDir, config } = await loadCommandContext(command);
+        let targetName;
+        if (opts.target) {
+          const target = resolveTarget(config, opts.target);
+          assertWebAuthStateTarget({ configDir, config, target });
+          targetName = target.name;
+        }
+        const metadata = await (0, import_agent_qa_core13.listAuthStateMetadata)({
+          configDir,
+          authStateDir: config.services?.authState?.dir,
+          targetName
+        });
+        printAuthStateList(metadata, targetName);
+      } catch (error) {
+        printSafeAuthStateError(error, "Could not list auth states.");
+        process.exitCode = 1;
+      }
+    })
+  );
+  cmd.addCommand(
+    new import_commander13.Command("remove").description("Remove saved auth state files for a target").requiredOption("--target <target>", "target name from agent-qa config").option("--name <name>", "logical auth-state name").action(async (opts, command) => {
+      let resolvedTargetName = opts.target;
+      try {
+        const { configDir, config } = await loadCommandContext(command);
+        const target = resolveTarget(config, opts.target);
+        resolvedTargetName = target.name;
+        if (opts.name) {
+          await (0, import_agent_qa_core13.removeAuthStateFiles)({
+            configDir,
+            authStateDir: config.services?.authState?.dir,
+            targetName: target.name,
+            stateName: opts.name,
+            target: { platform: target.platform }
+          });
+          console.log(`Removed auth state "${opts.name}" for target "${target.name}".`);
+          return;
+        }
+        await (0, import_agent_qa_core13.removeAuthStateTarget)({
+          configDir,
+          authStateDir: config.services?.authState?.dir,
+          targetName: target.name,
+          target: { platform: target.platform }
+        });
+        console.log(`Removed auth states for target "${target.name}".`);
+      } catch (error) {
+        printSafeAuthStateError(
+          error,
+          opts.name ? `Could not remove auth state "${opts.name}" for target "${resolvedTargetName}".` : `Could not remove auth states for target "${resolvedTargetName}".`
+        );
+        process.exitCode = 1;
+      }
+    })
+  );
+  cmd.addCommand(
+    new import_commander13.Command("capture").description("Capture a named web auth state for a target").requiredOption("--target <target>", "target name from agent-qa config").requiredOption("--name <name>", "logical auth-state name").action(async (opts, command) => {
+      let browser;
+      try {
+        const { configDir, config } = await loadCommandContext(command);
+        const target = resolveTarget(config, opts.target);
+        const paths = (0, import_agent_qa_core13.resolveAuthStatePaths)({
+          configDir,
+          authStateDir: config.services?.authState?.dir,
+          targetName: target.name,
+          stateName: opts.name,
+          target: { platform: target.platform }
+        });
+        if (!target.url) {
+          console.error(import_picocolors13.default.red(`Target "${target.name}" must define a web URL for auth-state capture.`));
+          process.exitCode = 1;
+          return;
+        }
+        const launchers = deps.launchers ?? await loadPlaywrightLaunchers();
+        const browserName = resolveBrowserName(config);
+        browser = await launchers[browserName].launch({ headless: false });
+        const context = await browser.newContext();
+        const page = await context.newPage();
+        await page.goto(target.url, { waitUntil: "domcontentloaded" });
+        const exists = await authStateExists(paths);
+        const waitForConfirmation = deps.waitForConfirmation ?? waitForCaptureConfirmation;
+        const confirmation = await waitForConfirmation({
+          browser,
+          message: buildConfirmationMessage(target.name, opts.name, exists)
+        });
+        if (confirmation === "cancelled") {
+          await closeBrowser(browser);
+          console.log("Auth-state capture cancelled.");
+          process.exitCode = 1;
+          return;
+        }
+        if (confirmation === "browser-closed") {
+          await closeBrowser(browser);
+          console.error(import_picocolors13.default.red("Browser was closed before auth state was saved."));
+          process.exitCode = 1;
+          return;
+        }
+        const payload = await context.storageState({ indexedDB: true });
+        try {
+          await (0, import_agent_qa_core13.writeAuthStateFiles)(paths, {
+            payload,
+            metadata: {
+              version: import_agent_qa_core13.AUTH_STATE_SCHEMA_VERSION,
+              kind: "web",
+              target: target.name,
+              name: opts.name,
+              capturedAt: (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()
+            }
+          });
+        } catch {
+          await closeBrowser(browser);
+          console.error(import_picocolors13.default.red(`Could not save auth state "${opts.name}" for target "${target.name}".`));
+          process.exitCode = 1;
+          return;
+        }
+        await closeBrowser(browser);
+        console.log(`Saved auth state "${opts.name}" for target "${target.name}".`);
+      } catch (error) {
+        await closeBrowser(browser);
+        console.error(import_picocolors13.default.red(error instanceof Error ? error.message : String(error)));
+        process.exitCode = 1;
+      }
+    })
+  );
+  return cmd;
+}
+
+// src/commands/devices.ts
+var import_commander14 = require("commander");
 var import_node_child_process5 = require("child_process");
 var import_node_fs4 = require("fs");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_yaml6 = require("yaml");
-var import_picocolors13 = __toESM(require("picocolors"), 1);
+var import_picocolors14 = __toESM(require("picocolors"), 1);
 init_config();
 function formatStatus2(transport, localBinding) {
   if (transport !== "local") {
-    return import_picocolors13.default.green("Ready") + import_picocolors13.default.dim(" (no local binding required)");
+    return import_picocolors14.default.green("Ready") + import_picocolors14.default.dim(" (no local binding required)");
   }
   if (!localBinding) {
-    return import_picocolors13.default.red("UNBOUND") + import_picocolors13.default.yellow(" - run `agent-qa devices init`");
+    return import_picocolors14.default.red("UNBOUND") + import_picocolors14.default.yellow(" - run `agent-qa devices init`");
   }
   const keys = Object.entries(localBinding).slice(0, 2);
   const details = keys.map(([k, v]) => `${k}: ${v}`).join(", ");
-  return import_picocolors13.default.green("Bound") + import_picocolors13.default.dim(` (${details})`);
+  return import_picocolors14.default.green("Bound") + import_picocolors14.default.dim(` (${details})`);
 }
 async function listDevices() {
   let config;
   try {
     config = await resolveConfig({});
   } catch (err) {
-    console.error(import_picocolors13.default.red(`Config error: ${err instanceof Error ? err.message : String(err)}`));
+    console.error(import_picocolors14.default.red(`Config error: ${err instanceof Error ? err.message : String(err)}`));
     process.exitCode = 1;
     return;
   }
   const devices = config.registry?.devices;
   if (!devices || Object.keys(devices).length === 0) {
-    console.log(import_picocolors13.default.yellow("No devices configured in registry.devices"));
+    console.log(import_picocolors14.default.yellow("No devices configured in registry.devices"));
     return;
   }
   const localBindings = loadLocalBindings();
@@ -5245,13 +5623,13 @@ async function listDevices() {
   const platWidth = 10;
   const transWidth = 14;
   console.log("");
-  console.log(import_picocolors13.default.bold("  Configured Devices"));
+  console.log(import_picocolors14.default.bold("  Configured Devices"));
   console.log("");
   console.log(
-    `  ${import_picocolors13.default.dim("Name".padEnd(nameWidth))}  ${import_picocolors13.default.dim("Platform".padEnd(platWidth))}  ${import_picocolors13.default.dim("Transport".padEnd(transWidth))}  ${import_picocolors13.default.dim("Status")}`
+    `  ${import_picocolors14.default.dim("Name".padEnd(nameWidth))}  ${import_picocolors14.default.dim("Platform".padEnd(platWidth))}  ${import_picocolors14.default.dim("Transport".padEnd(transWidth))}  ${import_picocolors14.default.dim("Status")}`
   );
   console.log(
-    `  ${import_picocolors13.default.dim("\u2500".repeat(nameWidth))}  ${import_picocolors13.default.dim("\u2500".repeat(platWidth))}  ${import_picocolors13.default.dim("\u2500".repeat(transWidth))}  ${import_picocolors13.default.dim("\u2500".repeat(30))}`
+    `  ${import_picocolors14.default.dim("\u2500".repeat(nameWidth))}  ${import_picocolors14.default.dim("\u2500".repeat(platWidth))}  ${import_picocolors14.default.dim("\u2500".repeat(transWidth))}  ${import_picocolors14.default.dim("\u2500".repeat(30))}`
   );
   for (const [name, profile] of Object.entries(devices)) {
     const localBinding = localBindings?.devices?.[name] ?? null;
@@ -5302,7 +5680,7 @@ function scanSimctlDevices() {
   }
 }
 function appendGitignoreEntry(dir, entry) {
-  const gitignorePath = (0, import_node_path11.join)(dir, ".gitignore");
+  const gitignorePath = (0, import_node_path12.join)(dir, ".gitignore");
   let existing = "";
   if ((0, import_node_fs4.existsSync)(gitignorePath)) {
     existing = (0, import_node_fs4.readFileSync)(gitignorePath, "utf-8");
@@ -5313,30 +5691,30 @@ function appendGitignoreEntry(dir, entry) {
 }
 async function initDevices() {
   const dir = process.cwd();
-  const localFilePath = (0, import_node_path11.join)(dir, "agent-qa.local.yaml");
+  const localFilePath = (0, import_node_path12.join)(dir, "agent-qa.local.yaml");
   if ((0, import_node_fs4.existsSync)(localFilePath)) {
-    console.log(import_picocolors13.default.yellow("agent-qa.local.yaml already exists. Skipping generation."));
+    console.log(import_picocolors14.default.yellow("agent-qa.local.yaml already exists. Skipping generation."));
     return;
   }
-  console.log(import_picocolors13.default.bold("\n  Scanning for connected devices...\n"));
+  console.log(import_picocolors14.default.bold("\n  Scanning for connected devices...\n"));
   const adbDevices = scanAdbDevices();
   const simctlDevices = scanSimctlDevices();
   if (adbDevices.length > 0) {
-    console.log(`  ${import_picocolors13.default.green("Android:")} found ${adbDevices.length} device(s)`);
+    console.log(`  ${import_picocolors14.default.green("Android:")} found ${adbDevices.length} device(s)`);
     for (const d of adbDevices) {
-      console.log(`    ${import_picocolors13.default.dim("\u2022")} ${d.model} (${d.serial})`);
+      console.log(`    ${import_picocolors14.default.dim("\u2022")} ${d.model} (${d.serial})`);
     }
   } else {
-    console.log(`  ${import_picocolors13.default.dim("Android:")} no devices found (adb not available or no devices connected)`);
+    console.log(`  ${import_picocolors14.default.dim("Android:")} no devices found (adb not available or no devices connected)`);
   }
   if (simctlDevices.length > 0) {
     const booted = simctlDevices.filter((d) => d.state === "Booted");
-    console.log(`  ${import_picocolors13.default.green("iOS:")} found ${simctlDevices.length} simulator(s) (${booted.length} booted)`);
+    console.log(`  ${import_picocolors14.default.green("iOS:")} found ${simctlDevices.length} simulator(s) (${booted.length} booted)`);
     for (const d of booted) {
-      console.log(`    ${import_picocolors13.default.dim("\u2022")} ${d.name} (${d.udid})`);
+      console.log(`    ${import_picocolors14.default.dim("\u2022")} ${d.name} (${d.udid})`);
     }
   } else {
-    console.log(`  ${import_picocolors13.default.dim("iOS:")} no simulators found (simctl not available or none installed)`);
+    console.log(`  ${import_picocolors14.default.dim("iOS:")} no simulators found (simctl not available or none installed)`);
   }
   let config;
   try {
@@ -5370,20 +5748,20 @@ async function initDevices() {
   (0, import_node_fs4.writeFileSync)(localFilePath, yamlContent);
   appendGitignoreEntry(dir, "agent-qa.local.yaml");
   console.log("");
-  console.log(import_picocolors13.default.green(`  Generated agent-qa.local.yaml with ${bindCount} device binding(s)`));
-  console.log(import_picocolors13.default.dim("  Added agent-qa.local.yaml to .gitignore"));
+  console.log(import_picocolors14.default.green(`  Generated agent-qa.local.yaml with ${bindCount} device binding(s)`));
+  console.log(import_picocolors14.default.dim("  Added agent-qa.local.yaml to .gitignore"));
   console.log("");
 }
 function createDevicesCommand() {
-  const cmd = new import_commander13.Command("devices").description("Manage device profiles and local bindings");
+  const cmd = new import_commander14.Command("devices").description("Manage device profiles and local bindings");
   cmd.command("list").description("Show configured devices with merged shared + local view").action(listDevices);
   cmd.command("init").description("Scan connected devices and generate agent-qa.local.yaml").action(initDevices);
   return cmd;
 }
 
 // src/commands/ids.ts
-var import_commander14 = require("commander");
-var import_picocolors14 = __toESM(require("picocolors"), 1);
+var import_commander15 = require("commander");
+var import_picocolors15 = __toESM(require("picocolors"), 1);
 var import_agent_qa_ids = require("@vostride/agent-qa-ids");
 function parseEntityType(value) {
   if (import_agent_qa_ids.ENTITY_ID_TYPES.includes(value)) {
@@ -5392,7 +5770,7 @@ function parseEntityType(value) {
   throw new Error(`Unknown ID type "${value}". Expected one of: ${import_agent_qa_ids.ENTITY_ID_TYPES.join(", ")}`);
 }
 function createIdsCommand() {
-  const cmd = new import_commander14.Command("ids").description("Generate and validate canonical agent-qa entity IDs");
+  const cmd = new import_commander15.Command("ids").description("Generate and validate canonical agent-qa entity IDs");
   cmd.command("generate").description("Generate a canonical agent-qa ID using id-agent").argument("<type>", `entity type: ${import_agent_qa_ids.ENTITY_ID_TYPES.join("|")}`).option("--json", "print structured JSON").action((typeValue, opts) => {
     try {
       const type = parseEntityType(typeValue);
@@ -5404,7 +5782,7 @@ function createIdsCommand() {
         console.log(id);
       }
     } catch (err) {
-      console.error(import_picocolors14.default.red(err instanceof Error ? err.message : String(err)));
+      console.error(import_picocolors15.default.red(err instanceof Error ? err.message : String(err)));
       process.exitCode = 1;
     }
   });
@@ -5423,15 +5801,15 @@ function createIdsCommand() {
       if (opts.json) {
         console.log(JSON.stringify(result, null, 2));
       } else if (valid) {
-        console.log(import_picocolors14.default.green(result.message));
+        console.log(import_picocolors15.default.green(result.message));
       } else {
-        console.error(import_picocolors14.default.red(result.message));
+        console.error(import_picocolors15.default.red(result.message));
       }
       if (!valid) {
         process.exitCode = 1;
       }
     } catch (err) {
-      console.error(import_picocolors14.default.red(err instanceof Error ? err.message : String(err)));
+      console.error(import_picocolors15.default.red(err instanceof Error ? err.message : String(err)));
       process.exitCode = 1;
     }
   });
@@ -5439,18 +5817,18 @@ function createIdsCommand() {
 }
 
 // src/commands/create-test.ts
-var import_commander15 = require("commander");
+var import_commander16 = require("commander");
 var import_agent_qa_ids2 = require("@vostride/agent-qa-ids");
 var import_yaml7 = require("yaml");
-var import_promises4 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_node_fs5 = require("fs");
-var import_node_path12 = require("path");
-var import_picocolors15 = __toESM(require("picocolors"), 1);
+var import_node_path13 = require("path");
+var import_picocolors16 = __toESM(require("picocolors"), 1);
 function createCreateTestCommand() {
-  const cmd = new import_commander15.Command("create-test").description("Scaffold a new test YAML file with auto-generated ID").argument("<path>", "output file path for the test YAML").action(async (path) => {
-    const resolved = (0, import_node_path12.resolve)(path);
+  const cmd = new import_commander16.Command("create-test").description("Scaffold a new test YAML file with auto-generated ID").argument("<path>", "output file path for the test YAML").action(async (path) => {
+    const resolved = (0, import_node_path13.resolve)(path);
     if ((0, import_node_fs5.existsSync)(resolved)) {
-      console.error(import_picocolors15.default.red("Error: File already exists: " + resolved));
+      console.error(import_picocolors16.default.red("Error: File already exists: " + resolved));
       process.exitCode = 1;
       return;
     }
@@ -5462,27 +5840,27 @@ function createCreateTestCommand() {
       steps: ["Describe your first test step here"]
     };
     const yamlContent = (0, import_yaml7.stringify)(template);
-    await (0, import_promises4.mkdir)((0, import_node_path12.dirname)(resolved), { recursive: true });
-    await (0, import_promises4.writeFile)(resolved, yamlContent, "utf-8");
-    console.log(import_picocolors15.default.green("Created " + resolved));
-    console.log(import_picocolors15.default.dim("  test-id: " + testId));
+    await (0, import_promises5.mkdir)((0, import_node_path13.dirname)(resolved), { recursive: true });
+    await (0, import_promises5.writeFile)(resolved, yamlContent, "utf-8");
+    console.log(import_picocolors16.default.green("Created " + resolved));
+    console.log(import_picocolors16.default.dim("  test-id: " + testId));
   });
   return cmd;
 }
 
 // src/commands/create-suite.ts
-var import_commander16 = require("commander");
+var import_commander17 = require("commander");
 var import_agent_qa_ids3 = require("@vostride/agent-qa-ids");
 var import_yaml8 = require("yaml");
-var import_promises5 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_node_fs6 = require("fs");
-var import_node_path13 = require("path");
-var import_picocolors16 = __toESM(require("picocolors"), 1);
+var import_node_path14 = require("path");
+var import_picocolors17 = __toESM(require("picocolors"), 1);
 function createCreateSuiteCommand() {
-  const cmd = new import_commander16.Command("create-suite").description("Scaffold a new suite YAML file with auto-generated ID").argument("<path>", "output file path for the suite YAML").action(async (path) => {
-    const resolved = (0, import_node_path13.resolve)(path);
+  const cmd = new import_commander17.Command("create-suite").description("Scaffold a new suite YAML file with auto-generated ID").argument("<path>", "output file path for the suite YAML").action(async (path) => {
+    const resolved = (0, import_node_path14.resolve)(path);
     if ((0, import_node_fs6.existsSync)(resolved)) {
-      console.error(import_picocolors16.default.red("Error: File already exists: " + resolved));
+      console.error(import_picocolors17.default.red("Error: File already exists: " + resolved));
       process.exitCode = 1;
       return;
     }
@@ -5496,22 +5874,22 @@ function createCreateSuiteCommand() {
       "tests: []",
       "tests: []\n  # - test: ./path/to/test.yaml\n  #   id: my-test-id"
     );
-    await (0, import_promises5.mkdir)((0, import_node_path13.dirname)(resolved), { recursive: true });
-    await (0, import_promises5.writeFile)(resolved, yamlContent, "utf-8");
-    console.log(import_picocolors16.default.green("Created " + resolved));
-    console.log(import_picocolors16.default.dim("  suite-id: " + suiteId));
+    await (0, import_promises6.mkdir)((0, import_node_path14.dirname)(resolved), { recursive: true });
+    await (0, import_promises6.writeFile)(resolved, yamlContent, "utf-8");
+    console.log(import_picocolors17.default.green("Created " + resolved));
+    console.log(import_picocolors17.default.dim("  suite-id: " + suiteId));
   });
   return cmd;
 }
 
 // src/commands/clean-memory.ts
-var import_commander17 = require("commander");
-var import_picocolors17 = __toESM(require("picocolors"), 1);
+var import_commander18 = require("commander");
+var import_picocolors18 = __toESM(require("picocolors"), 1);
 var import_node_readline3 = require("readline");
-var import_promises6 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_node_fs7 = require("fs");
-var import_node_path14 = require("path");
-var import_agent_qa_core13 = require("@vostride/agent-qa-core");
+var import_node_path15 = require("path");
+var import_agent_qa_core14 = require("@vostride/agent-qa-core");
 init_config();
 function formatSize(bytes) {
   if (bytes === 0) return "0 B";
@@ -5519,13 +5897,13 @@ function formatSize(bytes) {
   return `${(bytes / 1048576).toFixed(1)} MB`;
 }
 async function getOrphanInfo(memoryRoot, tier, scope) {
-  const scopePath = (0, import_node_path14.join)(memoryRoot, tier, scope);
-  const obsFiles = await (0, import_agent_qa_core13.listObservations)(scopePath);
+  const scopePath = (0, import_node_path15.join)(memoryRoot, tier, scope);
+  const obsFiles = await (0, import_agent_qa_core14.listObservations)(scopePath);
   let newest = null;
   for (const filename of obsFiles) {
     try {
-      const content = await (0, import_promises6.readFile)((0, import_node_path14.join)(scopePath, filename), "utf-8");
-      const { data } = (0, import_agent_qa_core13.parseObservation)(content, filename);
+      const content = await (0, import_promises7.readFile)((0, import_node_path15.join)(scopePath, filename), "utf-8");
+      const { data } = (0, import_agent_qa_core14.parseObservation)(content, filename);
       if (data?.last_confirmed) {
         if (!newest || data.last_confirmed > newest) {
           newest = data.last_confirmed;
@@ -5536,10 +5914,10 @@ async function getOrphanInfo(memoryRoot, tier, scope) {
   }
   let totalSize = 0;
   try {
-    const entries = await (0, import_promises6.readdir)(scopePath);
+    const entries = await (0, import_promises7.readdir)(scopePath);
     for (const entry of entries) {
       try {
-        const s = await (0, import_promises6.stat)((0, import_node_path14.join)(scopePath, entry));
+        const s = await (0, import_promises7.stat)((0, import_node_path15.join)(scopePath, entry));
         if (s.isFile()) totalSize += s.size;
       } catch {
       }
@@ -5547,7 +5925,7 @@ async function getOrphanInfo(memoryRoot, tier, scope) {
   } catch {
   }
   return {
-    path: (0, import_node_path14.join)(tier, scope),
+    path: (0, import_node_path15.join)(tier, scope),
     tier,
     scope,
     fileCount: obsFiles.length,
@@ -5556,21 +5934,21 @@ async function getOrphanInfo(memoryRoot, tier, scope) {
   };
 }
 function createCleanMemoryCommand() {
-  const cmd = new import_commander17.Command("clean-memory").description("Remove orphaned memory observation directories").option("-y, --yes", "skip confirmation prompt").action(async (_opts, command) => {
+  const cmd = new import_commander18.Command("clean-memory").description("Remove orphaned memory observation directories").option("-y, --yes", "skip confirmation prompt").action(async (_opts, command) => {
     const opts = command.opts();
     const configPath = command.parent?.opts()?.config ?? "agent-qa.config.yaml";
     const config = await resolveConfig({ configPath });
-    const workspace = (0, import_agent_qa_core13.resolveWorkspacePaths)({ config, configPath });
+    const workspace = (0, import_agent_qa_core14.resolveWorkspacePaths)({ config, configPath });
     const expectedProducts = /* @__PURE__ */ new Set();
     const targets = config.registry?.targets ?? {};
     for (const [name, entry] of Object.entries(targets)) {
       expectedProducts.add(entry?.product ?? name);
     }
     const expectedTests = /* @__PURE__ */ new Set();
-    for (const file of await (0, import_agent_qa_core13.discoverWorkspaceFiles)({ workspace, kind: "test" })) {
+    for (const file of await (0, import_agent_qa_core14.discoverWorkspaceFiles)({ workspace, kind: "test" })) {
       try {
-        const content = await (0, import_promises6.readFile)(file.absolutePath, "utf-8");
-        const result = (0, import_agent_qa_core13.parseTestFile)(content, file.workspaceRelativePath);
+        const content = await (0, import_promises7.readFile)(file.absolutePath, "utf-8");
+        const result = (0, import_agent_qa_core14.parseTestFile)(content, file.workspaceRelativePath);
         for (const t of result.tests) {
           if (t["test-id"]) expectedTests.add(t["test-id"]);
           expectedTests.add(t.name);
@@ -5579,17 +5957,17 @@ function createCleanMemoryCommand() {
       }
     }
     const expectedSuites = /* @__PURE__ */ new Set();
-    for (const file of await (0, import_agent_qa_core13.discoverWorkspaceFiles)({ workspace, kind: "suite" })) {
+    for (const file of await (0, import_agent_qa_core14.discoverWorkspaceFiles)({ workspace, kind: "suite" })) {
       try {
-        const suite = await (0, import_agent_qa_core13.parseSuiteFile)(file.absolutePath);
+        const suite = await (0, import_agent_qa_core14.parseSuiteFile)(file.absolutePath);
         if (suite["suite-id"]) expectedSuites.add(suite["suite-id"]);
         expectedSuites.add(suite.name);
       } catch {
       }
     }
-    const memoryRoot = (0, import_agent_qa_core13.resolveMemoryRoot)(config, workspace.configDir);
+    const memoryRoot = (0, import_agent_qa_core14.resolveMemoryRoot)(config, workspace.configDir);
     if (!(0, import_node_fs7.existsSync)(memoryRoot)) {
-      console.log(import_picocolors17.default.dim("No memory directory found."));
+      console.log(import_picocolors18.default.dim("No memory directory found."));
       return;
     }
     const TIERS = [
@@ -5599,16 +5977,16 @@ function createCleanMemoryCommand() {
     ];
     const orphans = [];
     for (const tier of TIERS) {
-      const tierPath = (0, import_node_path14.join)(memoryRoot, tier.dir);
+      const tierPath = (0, import_node_path15.join)(memoryRoot, tier.dir);
       let entries;
       try {
-        entries = await (0, import_promises6.readdir)(tierPath);
+        entries = await (0, import_promises7.readdir)(tierPath);
       } catch {
         continue;
       }
       for (const entry of entries) {
         try {
-          const s = await (0, import_promises6.stat)((0, import_node_path14.join)(tierPath, entry));
+          const s = await (0, import_promises7.stat)((0, import_node_path15.join)(tierPath, entry));
           if (!s.isDirectory()) continue;
         } catch {
           continue;
@@ -5619,17 +5997,17 @@ function createCleanMemoryCommand() {
       }
     }
     if (orphans.length === 0) {
-      console.log(import_picocolors17.default.dim("No orphaned memory directories found."));
+      console.log(import_picocolors18.default.dim("No orphaned memory directories found."));
       return;
     }
     const maxPathLen = Math.max("Path".length, ...orphans.map((o) => o.path.length));
     console.log("");
-    console.log(import_picocolors17.default.bold("Orphaned memory directories:"));
+    console.log(import_picocolors18.default.bold("Orphaned memory directories:"));
     console.log("");
-    console.log("  " + import_picocolors17.default.dim("Path".padEnd(maxPathLen + 2) + "Files".padStart(7) + "  " + "Last Confirmed".padEnd(20) + "Size".padStart(10)));
-    console.log("  " + import_picocolors17.default.dim("-".repeat(maxPathLen + 2 + 7 + 2 + 20 + 10)));
+    console.log("  " + import_picocolors18.default.dim("Path".padEnd(maxPathLen + 2) + "Files".padStart(7) + "  " + "Last Confirmed".padEnd(20) + "Size".padStart(10)));
+    console.log("  " + import_picocolors18.default.dim("-".repeat(maxPathLen + 2 + 7 + 2 + 20 + 10)));
     for (const o of orphans) {
-      const confirmed = o.lastConfirmed ?? import_picocolors17.default.dim("never");
+      const confirmed = o.lastConfirmed ?? import_picocolors18.default.dim("never");
       console.log("  " + o.path.padEnd(maxPathLen + 2) + String(o.fileCount).padStart(7) + "  " + String(confirmed).padEnd(20) + formatSize(o.size).padStart(10));
     }
     console.log("");
@@ -5645,23 +6023,23 @@ function createCleanMemoryCommand() {
       }
     }
     for (const orphan of orphans) {
-      await (0, import_promises6.rm)((0, import_node_path14.join)(memoryRoot, orphan.tier, orphan.scope), { recursive: true, force: true });
+      await (0, import_promises7.rm)((0, import_node_path15.join)(memoryRoot, orphan.tier, orphan.scope), { recursive: true, force: true });
     }
-    console.log(import_picocolors17.default.green(`Deleted ${orphans.length} orphaned director${orphans.length === 1 ? "y" : "ies"}.`));
+    console.log(import_picocolors18.default.green(`Deleted ${orphans.length} orphaned director${orphans.length === 1 ? "y" : "ies"}.`));
   });
   return cmd;
 }
 
 // src/commands/skills.ts
-var import_commander18 = require("commander");
+var import_commander19 = require("commander");
 var import_node_fs8 = require("fs");
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 var import_node_url = require("url");
 var import_meta4 = {};
 function findPackageRoot(startDir) {
-  let current = (0, import_node_path15.resolve)(startDir);
+  let current = (0, import_node_path16.resolve)(startDir);
   while (true) {
-    const packagePath = (0, import_node_path15.join)(current, "package.json");
+    const packagePath = (0, import_node_path16.join)(current, "package.json");
     if ((0, import_node_fs8.existsSync)(packagePath)) {
       try {
         const pkg = JSON.parse((0, import_node_fs8.readFileSync)(packagePath, "utf-8"));
@@ -5671,9 +6049,9 @@ function findPackageRoot(startDir) {
       } catch {
       }
     }
-    const parent = (0, import_node_path15.dirname)(current);
+    const parent = (0, import_node_path16.dirname)(current);
     if (parent === current) {
-      return (0, import_node_path15.resolve)(startDir);
+      return (0, import_node_path16.resolve)(startDir);
     }
     current = parent;
   }
@@ -5682,20 +6060,20 @@ function hasSkillDirectories(dir) {
   if (!(0, import_node_fs8.existsSync)(dir)) return false;
   try {
     return (0, import_node_fs8.readdirSync)(dir).some((entry) => {
-      const skillDir = (0, import_node_path15.join)(dir, entry);
-      return (0, import_node_fs8.statSync)(skillDir).isDirectory() && (0, import_node_fs8.existsSync)((0, import_node_path15.join)(skillDir, "SKILL.md"));
+      const skillDir = (0, import_node_path16.join)(dir, entry);
+      return (0, import_node_fs8.statSync)(skillDir).isDirectory() && (0, import_node_fs8.existsSync)((0, import_node_path16.join)(skillDir, "SKILL.md"));
     });
   } catch {
     return false;
   }
 }
-function resolveAgentQaSkillsDirectory(startDir = (0, import_node_path15.dirname)((0, import_node_url.fileURLToPath)(import_meta4.url))) {
+function resolveAgentQaSkillsDirectory(startDir = (0, import_node_path16.dirname)((0, import_node_url.fileURLToPath)(import_meta4.url))) {
   const packageRoot = findPackageRoot(startDir);
-  const packagedSkills = (0, import_node_path15.join)(packageRoot, "skills");
+  const packagedSkills = (0, import_node_path16.join)(packageRoot, "skills");
   if (hasSkillDirectories(packagedSkills)) {
     return { path: packagedSkills, source: "package" };
   }
-  const sourceSkills = (0, import_node_path15.resolve)(packageRoot, "../..", "skills");
+  const sourceSkills = (0, import_node_path16.resolve)(packageRoot, "../..", "skills");
   if (hasSkillDirectories(sourceSkills)) {
     return { path: sourceSkills, source: "source" };
   }
@@ -5709,21 +6087,21 @@ function parseSkillDescription(skillPath) {
 function listAgentQaSkills(skillsDir) {
   if (!hasSkillDirectories(skillsDir)) return [];
   return (0, import_node_fs8.readdirSync)(skillsDir).filter((entry) => {
-    const skillDir = (0, import_node_path15.join)(skillsDir, entry);
-    return (0, import_node_fs8.statSync)(skillDir).isDirectory() && (0, import_node_fs8.existsSync)((0, import_node_path15.join)(skillDir, "SKILL.md"));
+    const skillDir = (0, import_node_path16.join)(skillsDir, entry);
+    return (0, import_node_fs8.statSync)(skillDir).isDirectory() && (0, import_node_fs8.existsSync)((0, import_node_path16.join)(skillDir, "SKILL.md"));
   }).sort().map((entry) => {
-    const skillDir = (0, import_node_path15.join)(skillsDir, entry);
+    const skillDir = (0, import_node_path16.join)(skillsDir, entry);
     return {
       name: entry,
       path: skillDir,
-      description: parseSkillDescription((0, import_node_path15.join)(skillDir, "SKILL.md"))
+      description: parseSkillDescription((0, import_node_path16.join)(skillDir, "SKILL.md"))
     };
   });
 }
 function createSkillsCommand(options = {}) {
   const stdout = options.stdout ?? process.stdout;
   const stderr = options.stderr ?? process.stderr;
-  return new import_commander18.Command("skills").description("List packaged agent-qa skills").option("--json", "print machine-readable output").action((opts) => {
+  return new import_commander19.Command("skills").description("List packaged agent-qa skills").option("--json", "print machine-readable output").action((opts) => {
     const resolved = resolveAgentQaSkillsDirectory(options.startDir);
     const skills = listAgentQaSkills(resolved.path);
     if (resolved.source === "missing" || skills.length === 0) {
@@ -5804,7 +6182,7 @@ function rejectRemovedCliSurface(input3 = {}) {
 
 // src/cli.ts
 rejectRemovedCliSurface();
-var program = new import_commander19.Command();
+var program = new import_commander20.Command();
 program.enablePositionalOptions();
 program.name("agent-qa").description("AI-powered testing framework").version(VERSION);
 program.option("--config <path>", "config file path", "agent-qa.config.yaml").option("--log-level <level>", "log verbosity: silent|error|warn|info|debug").option("--verbose", "shorthand for --log-level debug").option("--quiet", "shorthand for --log-level silent");
@@ -5821,6 +6199,7 @@ program.addCommand(createQueueCommand());
 program.addCommand(createCacheCommand());
 program.addCommand(createValidateCommand());
 program.addCommand(createAuthCommand());
+program.addCommand(createAuthStateCommand());
 program.addCommand(createDevicesCommand());
 program.addCommand(createIdsCommand());
 program.addCommand(createCreateTestCommand());