argus-reviewer-e2e 0.3.1 → 0.4.0

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import { type ReviewProfile } from './review/packs.js';
 import type { Trust } from './trust.js';
 export interface ProviderRules {
     only?: string[];
@@ -46,6 +47,51 @@ export interface Sandbox {
      */
     allowForks: boolean;
 }
+/**
+ * Exploratory lane (roadmap E2.U4): free runtime capture today
+ * (console/pageerror/failed-request taps render as `observed` findings),
+ * bounded act policy later. Opt-in — `enabled` defaults to false. On
+ * untrusted checkouts the whole block is stripped by the config allowlist.
+ */
+export interface Explore {
+    /** Master switch for capture + act. Default false. */
+    enabled: boolean;
+    /** Step cap for the exploratory act policy (U4b). Default 20. */
+    maxSteps: number;
+    /** Model budget for the act policy (U4b). Unset = bounded by run budget. */
+    budgetUsd: number | undefined;
+}
+/**
+ * Verified expected state for `verify --app`: at least one of these must
+ * hold for the lane to pass — a page that merely loads is never a pass.
+ * All configured conditions are ANDed.
+ */
+export interface AppExpectation {
+    /** Substring that must appear in the a11y tree (case-insensitive). */
+    text?: string;
+    /** Regex source the final page URL must match. */
+    url?: string;
+    /** Playwright/CSS selector that must resolve at least one node. */
+    selector?: string;
+}
+/**
+ * `verify --app` lane (follow-through U3): a bounded natural-language task
+ * run on the ExploreLoop substrate. Opt-in — the lane is selected by the
+ * `--app` flag and this block supplies the task contract. Without `task`
+ * and at least one `expected` marker the lane records `blocked`.
+ */
+export interface AppLane {
+    /** Natural-language task the lane must accomplish. */
+    task: string | undefined;
+    /** Expected-state marker(s) the lane verifies deterministically. */
+    expected: AppExpectation | undefined;
+    /** Step cap for the task loop. Unset → explore.maxSteps. */
+    maxSteps: number | undefined;
+    /** Lane USD budget. Unset = bounded by run budget. */
+    budgetUsd: number | undefined;
+    /** Wall-clock cap in ms. Unset → lane default (120s). */
+    timeoutMs: number | undefined;
+}
 export interface Config {
     model: string;
     escalation_model: string;
@@ -61,7 +107,7 @@ export interface Config {
      */
     code_model: string | undefined;
     /**
-     * OpenRouter Decisions API model for typed adjudication (Jev). Defaults
+     * OpenRouter Decisions API model for typed adjudication (the confidence model). Defaults
      * to the pinned `typesafe/jev-1.13-20260917` — alias slugs like
      * `~typesafe/jev-latest` drift silently and thresholds are calibrated
      * to a version. Set to `''` to disable adjudication (regex-only mode).
@@ -80,6 +126,12 @@ export interface Config {
     testsDir: string | undefined;
     /** Directory for JUnit XML + JSON run report output. */
     reportDir: string | undefined;
+    /**
+     * How many `verify` run manifests the local history keeps
+     * (`<reportDir>/manifests/*.json`) — the dashboard/TUI run list reads it.
+     * `0` disables archival; unset defaults to 20 at write time.
+     */
+    reportRetention: number | undefined;
     /**
      * Named secrets for `td.type(name, { secret: true })`. The value is typed
      * locally and never sent to the model — the model only resolves the field.
@@ -140,13 +192,19 @@ export interface Config {
     recordStepCap: number | undefined;
     /**
      * Agent Zero instance for delegated tasks (`argus-reviewer delegate`,
-     * `heal: 'a0'`). `url` is the instance base URL — leave unset to let the
-     * `a0` CLI resolve it (saved host, AGENT_ZERO_HOST, Docker discovery).
-     * Least-privilege scoping (browser vs full desktop) is configured on the
-     * instance's gateway, not here.
+     * `heal: 'a0'`, `verify --a0`). `url` is the instance base URL — leave
+     * unset to let the `a0` CLI resolve it (saved host, AGENT_ZERO_HOST,
+     * Docker discovery). `maxTasks` caps delegations per `verify`/`run`
+     * invocation (verify lane default 1, heal default 5); `timeoutMs` is the
+     * per-task wall-clock bound for the verify lane. The lane is
+     * an explicit opt-in escalation and caps completed delegations at
+     * `inconclusive` — the agent's answer is self-reported evidence, never a
+     * `passed` verdict (live round-trip proven in #53).
      */
     a0: {
         url: string | undefined;
+        maxTasks: number | undefined;
+        timeoutMs: number | undefined;
     } | undefined;
     /**
      * Failure escalation for `run`. 'local' (default) heals via the vision
@@ -160,9 +218,20 @@ export interface Config {
      * `resolveConfig` — `enabled: false` by default so the lane is opt-in.
      */
     sandbox: Sandbox;
+    /**
+     * Exploratory lane. Always populated after `resolveConfig` —
+     * `enabled: false` by default so capture is opt-in.
+     */
+    explore: Explore;
+    /**
+     * `verify --app` task lane. Always populated after `resolveConfig` —
+     * every field unset by default so the lane blocks on missing contract
+     * rather than inventing one.
+     */
+    app: AppLane;
     /**
      * Code-review policy knobs. Always populated after `resolveConfig`.
-     * `secretsThreshold`: Jev `noul` probability at/above which a
+     * `secretsThreshold`: confidence-model `noul` probability at/above which a
      * secret-shaped diff literal is reported as a finding (below →
      * suppressed but audit-recorded). Default 0.3 — tune after dogfooding.
      * `maxComments`: cap on inline review comments posted per run
@@ -170,19 +239,22 @@ export interface Config {
      * `severityGate`: consumer-facing alias over `severity` — 'bug'
      * fails on bugs only, 'risk' fails on bug|risk. Unset → `severity`
      * list is authoritative.
-     * `triage`: Jev pre-review lane — 'off' no call, 'annotate' (default)
+     * `triage`: confidence-model pre-review lane — 'off' no call, 'annotate' (default)
      * records risk/deep-review/area into the report + sticky, 'route'
      * additionally swaps the code model to `lowRiskModel` on low-risk
-     * diffs. Jev routes/annotates, never gates — coverage is constant.
+     * diffs. The confidence model routes/annotates, never gates — coverage is constant.
      * `lowRiskModel`: the cheap code-model slug 'route' falls to; unset →
      * route keeps `code_model` (annotate-equivalent).
      * `findingThreshold`: P(false-positive) required to suppress a nit/q
-     * finding after Jev adjudication — 1.0 (default) is annotate-only,
+     * finding after confidence-model adjudication — 1.0 (default) is annotate-only,
      * lowering it suppresses progressively more low-confidence nits.
      * bug/risk are never suppressed.
      * `requestChanges`: allow the review event to escalate to
-     * REQUEST_CHANGES for proven blockers (probe-reproduced or Jev
+     * REQUEST_CHANGES for proven blockers (probe-reproduced or confidence-model
      * high-confidence). Default true — set false for advisory-only posting.
+     * `profiles`: named review lenses appended to the review prompt
+     * ('security'|'perf'|'debloat' — see src/review/packs.ts). Unknown names
+     * are dropped at config load. Default [] — no extra rubric.
      */
     review: {
         secretsThreshold: number;
@@ -192,16 +264,29 @@ export interface Config {
         lowRiskModel: string | undefined;
         findingThreshold: number;
         requestChanges: boolean;
+        profiles: ReviewProfile[];
+        /**
+         * Glob list of changed paths kept out of the review input. A configured
+         * list replaces the defaults (generated, fixture, golden, vendored
+         * paths); `[]` excludes nothing.
+         */
+        exclude: string[];
     };
 }
-export type ConfigInput = Partial<Omit<Config, 'provider' | 'sandbox' | 'review'>> & {
+export type ConfigInput = Partial<Omit<Config, 'provider' | 'sandbox' | 'review' | 'explore' | 'app'>> & {
     provider?: Partial<ProviderRules>;
     sandbox?: Partial<Sandbox>;
     review?: Partial<Config['review']>;
+    explore?: Partial<Explore>;
+    app?: Partial<AppLane>;
 };
 export declare const DEFAULT_RECORD_STEP_CAP = 40;
+export declare const DEFAULT_EXPLORE: Explore;
+export declare const DEFAULT_APP: AppLane;
 export declare const DEFAULT_SANDBOX: Sandbox;
 export declare function defineConfig(input: ConfigInput): ConfigInput;
+/** Keep only non-blank string expected-state markers; all-dropped means unconfigured. */
+export declare function sanitizeExpectation(input: unknown): AppExpectation | undefined;
 /**
  * Which severities fail the review status. `review.severityGate` is the
  * consumer-facing alias over `severity` — 'risk' fails on bug|risk,

package/dist/config.js

@@ -1,6 +1,20 @@
 import { pathToFileURL } from 'node:url';
+import { DEFAULT_REVIEW_EXCLUDE } from './review/scope.js';
+import { isReviewProfile } from './review/packs.js';
 import { JEV_DEFAULT_MODEL } from './vision/decisions.js';
 export const DEFAULT_RECORD_STEP_CAP = 40;
+export const DEFAULT_EXPLORE = {
+    enabled: false,
+    maxSteps: 20,
+    budgetUsd: undefined,
+};
+export const DEFAULT_APP = {
+    task: undefined,
+    expected: undefined,
+    maxSteps: undefined,
+    budgetUsd: undefined,
+    timeoutMs: undefined,
+};
 export const DEFAULT_SANDBOX = {
     enabled: false,
     image: undefined,
@@ -26,6 +40,7 @@ const defaults = {
     cacheDir: undefined,
     testsDir: undefined,
     reportDir: undefined,
+    reportRetention: undefined,
     secrets: undefined,
     pageSetup: undefined,
     openrouter: undefined,
@@ -40,6 +55,8 @@ const defaults = {
     a0: undefined,
     heal: 'local',
     sandbox: { ...DEFAULT_SANDBOX },
+    explore: { ...DEFAULT_EXPLORE },
+    app: { ...DEFAULT_APP },
     review: {
         secretsThreshold: 0.3,
         maxComments: 20,
@@ -48,6 +65,8 @@ const defaults = {
         lowRiskModel: undefined,
         findingThreshold: 1.0,
         requestChanges: true,
+        profiles: [],
+        exclude: [...DEFAULT_REVIEW_EXCLUDE],
     },
 };
 export function defineConfig(input) {
@@ -61,6 +80,32 @@ function posInt(v, dflt) {
 function prob01(v, dflt) {
     return v !== undefined && Number.isFinite(v) && v >= 0 && v <= 1 ? v : dflt;
 }
+/** Optional positive-integer config values stay undefined when absent or wrong-typed. */
+function optPosInt(v) {
+    return v !== undefined && Number.isInteger(v) && v >= 1 ? v : undefined;
+}
+/** Keep only non-blank string expected-state markers; all-dropped means unconfigured. */
+export function sanitizeExpectation(input) {
+    if (typeof input !== 'object' || input === null)
+        return undefined;
+    const raw = input;
+    // Whitespace-only markers are vacuous — a `' '` needle matches every
+    // accessibility tree. Trim at the boundary so they drop like ''.
+    const marker = (v) => typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined;
+    const expected = {};
+    const text = marker(raw.text);
+    if (text !== undefined)
+        expected.text = text;
+    const url = marker(raw.url);
+    if (url !== undefined)
+        expected.url = url;
+    const selector = marker(raw.selector);
+    if (selector !== undefined)
+        expected.selector = selector;
+    return expected.text === undefined && expected.url === undefined && expected.selector === undefined
+        ? undefined
+        : expected;
+}
 /**
  * Which severities fail the review status. `review.severityGate` is the
  * consumer-facing alias over `severity` — 'risk' fails on bug|risk,
@@ -103,10 +148,34 @@ export function resolveConfig(input = {}) {
     sandbox.maxProbes = posInt(sandbox.maxProbes, DEFAULT_SANDBOX.maxProbes);
     sandbox.timeoutMs = posInt(sandbox.timeoutMs, DEFAULT_SANDBOX.timeoutMs);
     sandbox.pidsLimit = posInt(sandbox.pidsLimit, DEFAULT_SANDBOX.pidsLimit);
+    // Same wrong-typed degrade as sandbox — a mis-typed flag must never
+    // self-enable the lane.
+    const rawExplore = typeof input.explore === 'object' && input.explore !== null ? input.explore : {};
+    const explore = { ...defaults.explore, ...rawExplore };
+    explore.enabled = rawExplore.enabled === true;
+    explore.maxSteps = posInt(explore.maxSteps, DEFAULT_EXPLORE.maxSteps);
+    explore.budgetUsd =
+        typeof explore.budgetUsd === 'number' &&
+            Number.isFinite(explore.budgetUsd) &&
+            explore.budgetUsd > 0
+            ? explore.budgetUsd
+            : undefined;
+    // Same wrong-typed degrade for the app lane contract — a mis-typed
+    // marker must never self-author a passing condition.
+    const rawApp = typeof input.app === 'object' && input.app !== null ? input.app : {};
+    const app = { ...defaults.app, ...rawApp };
+    app.task = typeof app.task === 'string' && app.task.trim() !== '' ? app.task : undefined;
+    app.expected = sanitizeExpectation(app.expected);
+    app.maxSteps = optPosInt(rawApp.maxSteps);
+    app.timeoutMs = optPosInt(rawApp.timeoutMs);
+    app.budgetUsd =
+        typeof app.budgetUsd === 'number' && Number.isFinite(app.budgetUsd) && app.budgetUsd > 0
+            ? app.budgetUsd
+            : undefined;
     const rawReview = typeof input.review === 'object' && input.review !== null ? input.review : {};
     const review = { ...defaults.review, ...rawReview };
     // Thresholds must be probabilities — anything else (NaN, >1,
-    // negative) would silently suppress or flood the Jev lanes.
+    // negative) would silently suppress or flood the confidence-model lanes.
     review.secretsThreshold = prob01(review.secretsThreshold, defaults.review.secretsThreshold);
     review.maxComments =
         typeof review.maxComments === 'number' &&
@@ -127,10 +196,39 @@ export function resolveConfig(input = {}) {
     // Advisory-only escape hatch — only literal `false` opts out; anything
     // else (mis-typed values included) keeps the default-true posture.
     review.requestChanges = review.requestChanges !== false;
-    const resolved = { ...defaults, ...input, provider, sandbox, review };
+    // Unknown profile names are rejected at config load — a typo silently
+    // disabling a lens is worse than dropping it. Non-array input means the
+    // field was mis-typed entirely and also drops to the empty default.
+    review.profiles = Array.isArray(rawReview.profiles)
+        ? [...new Set(rawReview.profiles.filter(isReviewProfile))]
+        : [];
+    review.exclude =
+        Array.isArray(rawReview.exclude) &&
+            rawReview.exclude.every((g) => typeof g === 'string' && g !== '')
+            ? [...rawReview.exclude]
+            : [...DEFAULT_REVIEW_EXCLUDE];
+    const resolved = { ...defaults, ...input, provider, sandbox, explore, app, review };
     resolved.recordStepCap = posInt(resolved.recordStepCap, DEFAULT_RECORD_STEP_CAP);
+    // Retention is a non-negative integer (0 = keep none) — a mis-typed or
+    // negative bound degrades to unset, never to "keep everything".
+    resolved.reportRetention =
+        typeof resolved.reportRetention === 'number' &&
+            Number.isInteger(resolved.reportRetention) &&
+            resolved.reportRetention >= 0
+            ? resolved.reportRetention
+            : undefined;
     if (resolved.heal !== 'a0')
         resolved.heal = 'local';
+    if (resolved.a0 !== undefined) {
+        // A0 bounds degrade like every other numeric knob — a hostile or
+        // mis-typed cap must not become unlimited tasks or no timeout.
+        const a0 = resolved.a0;
+        resolved.a0 = {
+            url: typeof a0.url === 'string' && a0.url !== '' ? a0.url : undefined,
+            maxTasks: optPosInt(a0.maxTasks),
+            timeoutMs: optPosInt(a0.timeoutMs),
+        };
+    }
     // '' is the documented opt-out — an empty slug would send a broken
     // model id to the decisions endpoint on every adjudication call.
     if (resolved.decisionModel === '')
@@ -188,7 +286,7 @@ export async function loadConfig(cwd, opts) {
             // legit consumer debugging "why is my config ignored") is invisible.
             try {
                 if ((await fs.stat(path.join(cwd, `${name}.ts`))).isFile()) {
-                    opts.note?.(`config: ${name}.ts ignored — untrusted checkouts load JSON config only`);
+                    opts.note?.(`config: ${name}.ts ignored – untrusted checkouts load JSON config only`);
                 }
             }
             catch {
@@ -208,7 +306,7 @@ export async function loadConfig(cwd, opts) {
                     const raw = await fs.readFile(file, 'utf8');
                     const parsed = JSON.parse(raw);
                     if (untrusted) {
-                        opts.note?.(`config: ${name}.json loaded untrusted — honoring ${[...UNTRUSTED_CONFIG_KEYS].join(', ')} only`);
+                        opts.note?.(`config: ${name}.json loaded untrusted – honoring ${[...UNTRUSTED_CONFIG_KEYS].join(', ')} only`);
                         return finish(filterUntrustedConfig(parsed));
                     }
                     return finish(parsed);

package/dist/detect.d.ts

@@ -15,16 +15,43 @@ export interface ExecResult {
     timedOut?: boolean;
     /** Signal the process was terminated by, when killed (e.g. 'SIGTERM'). */
     signal?: string | undefined;
+    /**
+     * The process never started (ENOENT — binary missing) — set by the real
+     * executor so callers don't sniff stderr text for the distinction.
+     */
+    spawnError?: boolean | undefined;
 }
 export type ExecFn = (cmd: string, args: string[], timeoutMs: number, 
 /** Extra env merged over process.env — keeps secrets out of `ps`/`/proc` argv. */
-env?: Record<string, string>) => Promise<ExecResult>;
+env?: Record<string, string>, 
+/**
+ * `baseEnv` replaces the inherited process environment wholesale — the
+ * caller's allowlist, not ambient env. Without it the child inherits
+ * process.env as before.
+ */
+opts?: {
+    baseEnv?: Record<string, string>;
+}) => Promise<ExecResult>;
 export declare const defaultExec: ExecFn;
 export type ProbeFn = (url: string, timeoutMs: number) => Promise<boolean>;
+/**
+ * The only environment keys an Agent Zero child process may inherit.
+ * Provider keys, GitHub tokens, `ARGUS_*`, and npm auth variables never
+ * propagate (R12) — the child is a remote agent harness, not an extension
+ * of this process's trust. Lives here (not in executor/a0.ts) because every
+ * `a0` spawn — delegation, the lane's `--version` preflight, and init's
+ * environment probe — must use it or the contract leaks.
+ */
+export declare const A0_CHILD_ENV_KEYS: readonly ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "TERM", "TMPDIR", "XDG_RUNTIME_DIR", "DOCKER_HOST", "AGENT_ZERO_HOST", "A0_USERNAME", "A0_PASSWORD"];
+/** Build the sanitized child env: allowlisted keys that exist in `env`. */
+export declare function buildA0ChildEnv(env: NodeJS.ProcessEnv | Record<string, string | undefined>): Record<string, string>;
 /**
  * Any HTTP response — including a login redirect — means *something* is up,
  * but port 5080 could be an unrelated service. Require an Agent Zero marker
- * in the served HTML before trusting the probe result.
+ * in the served HTML before trusting the probe result. Redirects are
+ * followed: a login-gated instance 302s `/` to `/login`, and the marker
+ * check must apply to the page the host actually serves, not the redirect
+ * stub — a hop to a non-Zero page still fails the marker check.
  */
 export declare const defaultProbe: ProbeFn;
 export interface A0Info {

package/dist/detect.js

@@ -2,15 +2,19 @@ import { execFile } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { readdir, readFile } from 'node:fs/promises';
-export const defaultExec = (cmd, args, timeoutMs, env) => new Promise((resolve) => {
+/** Grace between a timeout's SIGTERM and the escalation SIGKILL. */
+const EXEC_KILL_GRACE_MS = 2_000;
+export const defaultExec = (cmd, args, timeoutMs, env, opts) => new Promise((resolve) => {
+    const baseEnv = opts?.baseEnv ?? process.env;
     // 4 MiB headroom — the sandbox caps output itself after capture, and a
     // chatty probe hitting execFile's 1 MiB default would error instead of
     // reaching the harness classifier.
-    execFile(cmd, args, {
+    const child = execFile(cmd, args, {
         timeout: timeoutMs,
         maxBuffer: 4 * 1024 * 1024,
-        ...(env !== undefined ? { env: { ...process.env, ...env } } : {}),
+        env: { ...baseEnv, ...env },
     }, (err, stdout, stderr) => {
+        settled = true;
         if (err) {
             // stderr is '' (not undefined) on spawn ENOENT — fall back to the
             // error message so callers can distinguish "missing" from "failed".
@@ -23,27 +27,112 @@ export const defaultExec = (cmd, args, timeoutMs, env) => new Promise((resolve)
                 timedOut: err.killed === true &&
                     err.code !== 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER',
                 signal: typeof err.signal === 'string' ? err.signal : undefined,
+                spawnError: err.code === 'ENOENT',
             });
         }
         else {
             resolve({ code: 0, stdout: String(stdout), stderr: String(stderr) });
         }
     });
+    let settled = false;
+    // execFile's timeout only delivers SIGTERM — a child that traps it (or a
+    // descendant holding the stdio pipes open) would keep this promise
+    // pending forever. Escalate to SIGKILL after a short grace, and resolve
+    // anyway if even that can't make the callback fire.
+    const escalate = setTimeout(() => {
+        if (settled)
+            return;
+        try {
+            child.kill('SIGKILL');
+        }
+        catch {
+            // already gone
+        }
+        setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                resolve({ code: 1, stdout: '', stderr: 'process killed', timedOut: true });
+            }
+        }, EXEC_KILL_GRACE_MS).unref();
+    }, timeoutMs + EXEC_KILL_GRACE_MS);
+    escalate.unref();
+    child.on('close', () => clearTimeout(escalate));
 });
+/**
+ * The only environment keys an Agent Zero child process may inherit.
+ * Provider keys, GitHub tokens, `ARGUS_*`, and npm auth variables never
+ * propagate (R12) — the child is a remote agent harness, not an extension
+ * of this process's trust. Lives here (not in executor/a0.ts) because every
+ * `a0` spawn — delegation, the lane's `--version` preflight, and init's
+ * environment probe — must use it or the contract leaks.
+ */
+export const A0_CHILD_ENV_KEYS = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'LANG',
+    'LC_ALL',
+    'TERM',
+    'TMPDIR',
+    'XDG_RUNTIME_DIR',
+    'DOCKER_HOST',
+    // The resolved host pointer — a URL, not a credential.
+    'AGENT_ZERO_HOST',
+    // Headless auth for login-gated instances: the a0 CLI itself consumes
+    // these (headless has no other auth path — session cookies only persist
+    // via the interactive TUI's remember-host flow). Operator-set only; they
+    // scope to the a0 host, not to any provider.
+    'A0_USERNAME',
+    'A0_PASSWORD',
+];
+/** Build the sanitized child env: allowlisted keys that exist in `env`. */
+export function buildA0ChildEnv(env) {
+    const out = {};
+    for (const key of A0_CHILD_ENV_KEYS) {
+        const value = env[key];
+        if (value !== undefined && value !== '')
+            out[key] = value;
+    }
+    return out;
+}
 /**
  * Any HTTP response — including a login redirect — means *something* is up,
  * but port 5080 could be an unrelated service. Require an Agent Zero marker
- * in the served HTML before trusting the probe result.
+ * in the served HTML before trusting the probe result. Redirects are
+ * followed: a login-gated instance 302s `/` to `/login`, and the marker
+ * check must apply to the page the host actually serves, not the redirect
+ * stub — a hop to a non-Zero page still fails the marker check.
  */
 export const defaultProbe = async (url, timeoutMs) => {
     try {
         const res = await fetch(url, {
             signal: AbortSignal.timeout(timeoutMs),
-            redirect: 'manual',
+            redirect: 'follow',
         });
         if (res.status >= 500)
             return false;
-        const body = (await res.text()).slice(0, 65_536);
+        // Bound the bytes actually received — a misbehaving host streaming an
+        // unbounded body inside the probe window would otherwise be fully
+        // buffered by res.text() before the slice.
+        const reader = res.body?.getReader();
+        if (reader === undefined)
+            return false;
+        const chunks = [];
+        let received = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            chunks.push(value);
+            if (received >= 65_536) {
+                await reader.cancel();
+                break;
+            }
+        }
+        const body = new TextDecoder().decode(chunks.length === 1 ? chunks[0] : Buffer.concat(chunks));
         return /agent.?zero/i.test(body);
     }
     catch {
@@ -105,7 +194,9 @@ export async function detectEnvironment(env, opts = {}) {
     const exec = opts.exec ?? defaultExec;
     const home = opts.home ?? homedir();
     const [a0Version, gh, browsers, a0Host] = await Promise.all([
-        exec('a0', ['--version'], 5_000),
+        // Even the presence probe gets the allowlisted env — an `a0` binary is
+        // third-party code and never sees provider/git secrets.
+        exec('a0', ['--version'], 5_000, undefined, { baseEnv: buildA0ChildEnv(env) }),
         exec('gh', ['auth', 'status'], 5_000),
         playwrightBrowsers(home),
         resolveA0Host(env, opts),

package/dist/driver/browser.d.ts

@@ -16,7 +16,28 @@ export interface BrowserDriverOptions {
     browser?: 'chromium' | 'firefox' | 'webkit' | undefined;
     /** Hard limit in ms for Playwright cleanup. */
     browserTimeoutMs?: number | undefined;
+    /**
+     * Exploratory capture (U4a): record page errors, console errors, and
+     * failed same-origin requests during the run. Free — no model calls.
+     */
+    captureErrors?: boolean;
 }
+/**
+ * One runtime anomaly observed while the browser was driving the app —
+ * becomes an `observed` finding on the run report. Captures never change a
+ * verdict; they are evidence, not adjudication.
+ */
+export interface PageCapture {
+    kind: 'console-error' | 'pageerror' | 'request-failed';
+    /** Normalized, truncated message or failure signature. */
+    text: string;
+    /** Failing request URL (request-failed only, same-origin only). */
+    url?: string;
+    /** Collapsed repeat count for this signature. */
+    count: number;
+}
+/** Distinct capture signatures kept per browser session. */
+export declare const MAX_CAPTURE_SIGNATURES = 50;
 export interface Observation {
     screenshotJpeg: Buffer;
     a11yYaml: string;
@@ -38,8 +59,19 @@ export declare class BrowserDriver {
     private readonly browserTimeoutMs;
     private video;
     private closed;
+    private readonly captures;
     private constructor();
     static launch(options?: BrowserDriverOptions): Promise<BrowserDriver>;
+    /**
+     * Exploratory capture taps (U4a). Noise controls are applied at collection:
+     * identical signatures collapse into one capture with a repeat count,
+     * request-failed events drop third-party origins (analytics/tag beacons
+     * failing is noise, not signal), and distinct signatures are capped.
+     */
+    private _attachCaptureTaps;
+    private _addCapture;
+    /** Captured page anomalies for this session — empty unless captureErrors. */
+    pageCaptures(): PageCapture[];
     get rawPage(): Page;
     get recordingDir(): string;
     goto(url: string): Promise<void>;