ccqa 0.11.0 → 0.13.0

package/dist/bin/ccqa.mjs

@@ -2630,6 +2630,7 @@ const ReportSpecResultSchema = z.object({
 });
 const RunReportDataSchema = z.object({
 	schemaVersion: z.literal(1),
+	kind: z.enum(["run", "drift"]).default("run"),
 	createdAt: z.string(),
 	runId: z.string().nullable(),
 	git: z.object({
@@ -3198,6 +3199,44 @@ function resolveProjectOrThrow(project, cwd) {
 */
 const hubUrlOption = ["--hub-url <url>", "ccqa hub base URL (or CCQA_HUB_URL)."];
 const hubTokenOption = ["--hub-token <token>", "ccqa hub bearer token (or CCQA_HUB_TOKEN)."];
+const hubHeaderOption = [
+	"--hub-header <header>",
+	"Extra header sent with every hub request, as \"key:value\" (or CCQA_HUB_HEADER). Repeatable. For infra that gates the hub behind a header check (e.g. a load balancer bypass rule).",
+	collectHubHeader,
+	[]
+];
+/** commander `--hub-header` accumulator: collects repeated flags into an array. */
+function collectHubHeader(value, previous) {
+	return [...previous, value];
+}
+/**
+* Parse `"key:value"` entries (from `--hub-header`, repeatable) into a
+* headers map. The value may itself contain `:` (e.g. a URL), so only the
+* first colon is treated as the separator. Throws on an entry with no colon.
+*/
+function parseHubHeaders(entries) {
+	const headers = {};
+	for (const entry of entries) {
+		const i = entry.indexOf(":");
+		if (i < 0) throw new Error(`invalid --hub-header (expected "key:value"): ${entry}`);
+		const key = entry.slice(0, i).trim();
+		const value = entry.slice(i + 1).trim();
+		if (!key) throw new Error(`invalid --hub-header (expected "key:value"): ${entry}`);
+		headers[key] = value;
+	}
+	return headers;
+}
+/**
+* Resolve custom hub headers from flags, falling back to `CCQA_HUB_HEADER`
+* (a single `"key:value"` entry) when no `--hub-header` flag was given.
+* CI setups typically pass exactly one gateway header via env; `--hub-header`
+* is repeatable for the (rarer) local/multi-header case.
+*/
+function resolveHubHeaders(hubHeader) {
+	if (hubHeader && hubHeader.length > 0) return parseHubHeaders(hubHeader);
+	const envHeader = process.env.CCQA_HUB_HEADER;
+	if (envHeader) return parseHubHeaders([envHeader]);
+}
 /** Thrown by `requireHubClient` when the URL and/or token can't be resolved from flags/env. */
 var HubConnectionError = class extends Error {
 	constructor(message) {
@@ -3214,9 +3253,11 @@ function resolveHubClient(opts) {
 	const baseUrl = opts.hubUrl ?? process.env.CCQA_HUB_URL;
 	const token = opts.hubToken ?? process.env.CCQA_HUB_TOKEN;
 	if (!baseUrl || !token) return null;
+	const headers = resolveHubHeaders(opts.hubHeader);
 	return createHubClient({
 		baseUrl: baseUrl.replace(/\/+$/, ""),
-		token
+		token,
+		...headers ? { headers } : {}
 	});
 }
 /** Same as `resolveHubClient`, but throws `HubConnectionError` instead of returning `null`. */
@@ -3242,6 +3283,25 @@ function resolveHubContext(opts) {
 		project: resolveProjectOrThrow(opts.project, opts.cwd ?? process.cwd())
 	};
 }
+/**
+* Wrap a subcommand action so a `HubApiError` (hub request failed, e.g. a
+* 503 when the hub has no encryption key configured) prints a clean message
+* and exits 2, instead of surfacing as an unhandled rejection with a stack
+* trace.
+*/
+function withHubErrors(fn) {
+	return async (...args) => {
+		try {
+			await fn(...args);
+		} catch (err) {
+			if (err instanceof HubApiError) {
+				error(`hub request failed (${err.status} ${err.code}): ${err.message}`);
+				process.exit(2);
+			}
+			throw err;
+		}
+	};
+}
 //#endregion
 //#region src/cli/options.ts
 /**
@@ -3266,7 +3326,7 @@ function addProfileOption(command) {
 * options so help text and behaviour don't drift.
 */
 function addHubOptions(command) {
-	return command.option(...hubUrlOption).option(...hubTokenOption);
+	return command.option(...hubUrlOption).option(...hubTokenOption).option(...hubHeaderOption);
 }
 /**
 * CLI wrapper around `resolveProfileEnv`: on failure, print the error and
@@ -3856,6 +3916,33 @@ function resolvePromptLocalPath(name, cwd) {
 	return join(cwd ?? process.cwd(), PROMPT_LOCAL_PATHS[name]);
 }
 //#endregion
+//#region src/cli/git-branch.ts
+/** Best-effort current branch: CI env vars first, then git, else null. */
+async function detectBranch(cwd) {
+	const fromEnv = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME;
+	if (fromEnv) return fromEnv;
+	try {
+		const { stdout } = await execFileP("git", [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		], { cwd });
+		const branch = stdout.trim();
+		return branch && branch !== "HEAD" ? branch : null;
+	} catch {
+		return null;
+	}
+}
+/** Best-effort current commit SHA, or null (e.g. not a git repo). */
+async function getGitHead(cwd) {
+	try {
+		const { stdout } = await execFileP("git", ["rev-parse", "HEAD"], { cwd });
+		return stdout.trim() || null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/cli/hub.ts
 /**
 * `ccqa hub` — the client side of the ccqa hub (a results/secret control
@@ -3904,25 +3991,6 @@ async function readStdin() {
 	for await (const chunk of process.stdin) chunks.push(chunk);
 	return Buffer.concat(chunks).toString("utf8");
 }
-/**
-* Wrap a subcommand action so a `HubApiError` (hub request failed, e.g. a
-* 503 when the hub has no encryption key configured) prints a clean message
-* and exits 2, instead of surfacing as an unhandled rejection with a stack
-* trace.
-*/
-function withHubErrors(fn) {
-	return async (...args) => {
-		try {
-			await fn(...args);
-		} catch (err) {
-			if (err instanceof HubApiError) {
-				error(`hub request failed (${err.status} ${err.code}): ${err.message}`);
-				process.exit(2);
-			}
-			throw err;
-		}
-	};
-}
 const sessionPush = new Command("push").description("Upload a locally-saved browser session (.ccqa/sessions/<profile>/<name>.json) to the hub, so it's available for `ccqa run` to fetch at run time. Encrypted at rest on the hub.").argument("<name>", "Session name to upload (resolves to .ccqa/sessions/<profile>/<name>.json)").option(...hubUrlOption).option(...hubTokenOption).option(...projectOption$1).option(...profileOption$1).option("--cwd <path>", "Project root containing .ccqa/ (defaults to the current directory).").action(withHubErrors(async (rawName, opts) => {
 	const name = validateSessionName(rawName);
 	const cwd = resolveCwd(opts.cwd);
@@ -4084,22 +4152,6 @@ const pushCommand = new Command("push").description("Upload the report directory
 	info(`${resolveBaseUrl(opts)}/#/runs/${run.id}`);
 }));
 const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(sessionCommand$1).addCommand(varCommand).addCommand(promptCommand);
-/** Best-effort current branch: CI env vars first, then git, else null. */
-async function detectBranch(cwd) {
-	const fromEnv = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME;
-	if (fromEnv) return fromEnv;
-	try {
-		const { stdout } = await execFileP("git", [
-			"rev-parse",
-			"--abbrev-ref",
-			"HEAD"
-		], { cwd });
-		const branch = stdout.trim();
-		return branch && branch !== "HEAD" ? branch : null;
-	} catch {
-		return null;
-	}
-}
 /** Loose check that a fetched session is agent-browser storage-state, mirroring loadStorageState. */
 function isStorageStateShape(state) {
 	return typeof state === "object" && state !== null && Array.isArray(state.cookies) && Array.isArray(state.origins);
@@ -5206,7 +5258,8 @@ async function executeRun(targets, opts) {
 				project: projectForProfile,
 				cwd,
 				hubUrl: opts.hubUrl,
-				hubToken: opts.hubToken
+				hubToken: opts.hubToken,
+				hubHeader: opts.hubHeader
 			});
 		} else await resolveProfileEnv({
 			profile: void 0,
@@ -5224,6 +5277,7 @@ async function executeRun(targets, opts) {
 		hubCtx = resolveHubContext({
 			hubUrl: opts.hubUrl,
 			hubToken: opts.hubToken,
+			hubHeader: opts.hubHeader,
 			project: opts.project,
 			cwd
 		});
@@ -5573,6 +5627,7 @@ async function writeUnifiedReport(args) {
 	const { reportDir, results, diff, baseRef, customPromptVersion, opts } = args;
 	const data = {
 		schemaVersion: 1,
+		kind: "run",
 		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 		runId: process.env["GITHUB_RUN_ID"] ?? null,
 		git: {
@@ -8584,7 +8639,8 @@ const recordCommand = addHubOptions(addProfileOption(addLanguageOption(new Comma
 		project,
 		cwd: cwdForProfile,
 		hubUrl: opts.hubUrl,
-		hubToken: opts.hubToken
+		hubToken: opts.hubToken,
+		hubHeader: opts.hubHeader
 	});
 	else await applyProfileFromOption({
 		profile: void 0,
@@ -8593,7 +8649,8 @@ const recordCommand = addHubOptions(addProfileOption(addLanguageOption(new Comma
 	});
 	const hubClientForTrace = resolveHubClient({
 		hubUrl: opts.hubUrl,
-		hubToken: opts.hubToken
+		hubToken: opts.hubToken,
+		hubHeader: opts.hubHeader
 	});
 	const hubContext = hubClientForTrace && project ? {
 		hub: hubClientForTrace,
@@ -9148,6 +9205,55 @@ function determineExitCode(results, threshold) {
 	}
 	return 0;
 }
+/**
+* Spec-level status under the given threshold, mirroring determineExitCode's
+* per-issue logic (exit-code.ts) but scoped to a single SpecResult.
+*/
+function specStatus(result, threshold) {
+	if (result.error) return "failed";
+	for (const issue of result.issues) {
+		if (issue.severity === "ERROR") return "failed";
+		if (threshold === "warn" && issue.severity === "WARN") return "failed";
+	}
+	return "passed";
+}
+/**
+* Adapts `ccqa drift` results into the shared RunReportData shape so they can
+* be pushed to the hub (`ccqa drift --push`) and rendered by the same report
+* UI as `ccqa run`/`ccqa live`. Browser-execution fields (testCounts,
+* evidence, liveRun, ...) don't apply to a drift audit and are always null.
+*/
+function driftResultsToReport(results, meta) {
+	const specResults = results.map((result) => ({
+		feature: result.target.featureName,
+		spec: result.target.specName,
+		title: null,
+		status: specStatus(result, meta.threshold),
+		testCounts: null,
+		durationMs: null,
+		assertions: null,
+		analysis: null,
+		analysisSkipped: null,
+		driftIssues: result.issues,
+		failureLogExcerpt: null,
+		diffExcerpt: null,
+		specYaml: null,
+		evidence: null,
+		liveRun: null
+	}));
+	return {
+		schemaVersion: 1,
+		kind: "drift",
+		createdAt: meta.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		runId: meta.runId ?? null,
+		git: meta.git,
+		model: meta.model ?? null,
+		language: meta.language ?? null,
+		promptVersion: meta.promptVersion ?? "1",
+		customPromptVersion: null,
+		results: specResults
+	};
+}
 //#endregion
 //#region src/drift/route-new-files.ts
 /**
@@ -9263,7 +9369,7 @@ Return the spec keys that might be affected by any of the new files. Conservativ
 //#endregion
 //#region src/cli/drift.ts
 const DEFAULT_CONCURRENCY = 3;
-const driftCommand = addLanguageOption(new Command("drift").argument("[feature/spec]", "Optional spec id. If omitted, every spec under .ccqa/features/ is checked.").description("Standalone spec ↔ codebase static audit. Use for PR checks where the browser isn't run. For run-time audit with a structured report, see `ccqa run --report`.").option("--format <fmt>", "Output format: text | json | github", "text").option("--severity <level>", "Exit non-zero on this severity or higher: warn | error", "error").option("--concurrency <n>", `Parallel spec checks (default: ${DEFAULT_CONCURRENCY})`).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--cwd <path>", "Working directory used as both the .ccqa root and the codebase Claude reads. Useful for monorepos. Defaults to process.cwd().").option("--changed", "Restrict drift checks to specs whose relatedPaths intersect the git diff against --base (or, in CI, $GITHUB_BASE_REF, else origin/main). New files are routed to specs via a single lightweight Claude call.").option("--base <ref>", "Base ref to diff against when --changed is set. Defaults to $GITHUB_BASE_REF (CI) or origin/main.")).action(async (specPath, opts) => {
+const driftCommand = addLanguageOption(new Command("drift").argument("[feature/spec]", "Optional spec id. If omitted, every spec under .ccqa/features/ is checked.").description("Standalone spec ↔ codebase static audit. Use for PR checks where the browser isn't run. For run-time audit with a structured report, see `ccqa run --report`.").option("--format <fmt>", "Output format: text | json | github", "text").option("--severity <level>", "Exit non-zero on this severity or higher: warn | error", "error").option("--concurrency <n>", `Parallel spec checks (default: ${DEFAULT_CONCURRENCY})`).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--cwd <path>", "Working directory used as both the .ccqa root and the codebase Claude reads. Useful for monorepos. Defaults to process.cwd().").option("--changed", "Restrict drift checks to specs whose relatedPaths intersect the git diff against --base (or, in CI, $GITHUB_BASE_REF, else origin/main). New files are routed to specs via a single lightweight Claude call.").option("--base <ref>", "Base ref to diff against when --changed is set. Defaults to $GITHUB_BASE_REF (CI) or origin/main.").option("--push", "Push the drift result to a ccqa hub as a run (kind: drift).").option("--project <name>", "Logical project name for the pushed run. Defaults to the current directory's name.").option(...hubUrlOption).option(...hubTokenOption).option(...hubHeaderOption)).action(async (specPath, opts) => {
 	const format = parseFormat(opts.format);
 	const threshold = parseSeverity(opts.severity);
 	const concurrency = parseConcurrency(opts.concurrency);
@@ -9279,6 +9385,7 @@ const driftCommand = addLanguageOption(new Command("drift").argument("[feature/s
 		header("drift", specPath ?? `${targets.length} spec${targets.length > 1 ? "s" : ""}`);
 		if (opts.cwd) meta("cwd", cwd);
 	}
+	const baseRef = opts.changed ? resolveBaseRef(opts.base) : null;
 	if (opts.changed) {
 		const total = targets.length;
 		targets = await filterByChanged({
@@ -9304,8 +9411,69 @@ const driftCommand = addLanguageOption(new Command("drift").argument("[feature/s
 		}
 	});
 	process.stdout.write(renderDrift(results, format, cwd));
+	if (opts.push) await pushDriftResults({
+		results,
+		threshold,
+		cwd,
+		opts,
+		format,
+		baseRef
+	});
 	process.exit(determineExitCode(results, threshold));
 });
+/**
+* Push a finished drift audit to a ccqa hub as a `kind: "drift"` run, so it
+* shows up alongside `ccqa run` runs in the hub UI. Best-effort: a missing
+* hub connection warns and returns rather than failing the command (`--push`
+* never changes drift's own exit code).
+*
+* `resolveHub` is injectable so tests can supply a fake `HubClient` without
+* a real hub connection; it defaults to the real flag/env resolution.
+*/
+async function pushDriftResults(args, resolveHub = resolveHubClient) {
+	const { results, threshold, cwd, opts, format, baseRef } = args;
+	const hub = resolveHub(opts);
+	if (!hub) {
+		warn("--push requires a hub connection (--hub-url/--hub-token or CCQA_HUB_URL/CCQA_HUB_TOKEN) — skipping push");
+		return;
+	}
+	try {
+		const project = resolveProject({
+			project: opts.project,
+			cwd
+		});
+		const [branch, head] = await Promise.all([detectBranch(cwd), getGitHead(cwd)]);
+		const report = driftResultsToReport(results, {
+			threshold,
+			git: {
+				head,
+				base: baseRef ?? null
+			}
+		});
+		const dir = await mkdtemp(join(tmpdir(), "ccqa-drift-push-"));
+		try {
+			await writeFile(join(dir, "report.json"), JSON.stringify(report, null, 2), "utf8");
+			const archive = await packDirToTarGz(dir);
+			const run = await hub.pushRun(archive, {
+				project,
+				...branch ? { branch } : {},
+				kind: "drift"
+			});
+			if (format === "text") info(`pushed drift result to hub: ${(opts.hubUrl ?? process.env.CCQA_HUB_URL ?? "").replace(/\/+$/, "")}/#/runs/${run.id}`);
+		} finally {
+			await rm(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	} catch (err) {
+		if (err instanceof HubApiError) {
+			error(`hub request failed (${err.status} ${err.code}): ${err.message}`);
+			process.exit(2);
+		}
+		throw err;
+	}
+}
 function exitWithNoSpecs(format, message) {
 	if (format === "json") process.stdout.write(`${JSON.stringify({ specs: [] }, null, 2)}\n`);
 	else if (format === "text") info(message);
@@ -10073,6 +10241,13 @@ z.object({
 	profile: z.string().nullable(),
 	branch: z.string().nullable(),
 	status: RunStatusSchema,
+	kind: z.enum(["run", "drift"]).default("run"),
+	drift: z.object({
+		issues: z.number(),
+		errors: z.number(),
+		warnings: z.number(),
+		specsWithIssues: z.number()
+	}).nullable().default(null),
 	specs: z.object({
 		total: z.number(),
 		passed: z.number(),
@@ -10207,6 +10382,9 @@ function createPushRunHandler(config) {
 		const branch = requireBranch(ctx.url.searchParams.get("branch"));
 		const profileRaw = ctx.url.searchParams.get("profile");
 		const profile = profileRaw ? requireSafeSegment(profileRaw, "profile") : null;
+		const kindRaw = ctx.url.searchParams.get("kind");
+		if (kindRaw !== null && kindRaw !== "run" && kindRaw !== "drift") throw new HttpError(400, "invalid_param", `invalid kind: must be "run" or "drift"`);
+		const kind = kindRaw ?? "run";
 		const body = await readBody(ctx.req, maxPushBytes);
 		const dir = await mkdtemp(join(tmpdir(), "ccqa-hub-push-"));
 		try {
@@ -10224,15 +10402,19 @@ function createPushRunHandler(config) {
 			const parsed = RunReportDataSchema.safeParse(reportJson);
 			if (!parsed.success) throw new HttpError(400, "invalid_report", `report.json is not a valid report: ${parsed.error.issues[0]?.message ?? "schema mismatch"}`);
 			const report = parsed.data;
+			if (report.kind !== kind) throw new HttpError(400, "kind_mismatch", `?kind=${kind} does not match report.json's kind ("${report.kind}") — push with the matching ?kind= query param`);
 			const total = report.results.length;
 			const failed = report.results.filter((r) => r.status === "failed").length;
 			const status = failed > 0 ? "failed" : "passed";
+			const drift = kind === "drift" ? summarizeDrift(report.results) : null;
 			const run = {
 				id: randomUUID(),
 				project,
 				profile,
 				branch,
 				status,
+				kind,
+				drift,
 				specs: {
 					total,
 					passed: total - failed,
@@ -10317,6 +10499,28 @@ async function getRunOr404(storage, id) {
 	if (!run) throw new HttpError(404, "not_found", `run "${id}" not found`);
 	return run;
 }
+/** Tally `driftIssues` across all specs into the `Run.drift` summary counters. */
+function summarizeDrift(results) {
+	let issues = 0;
+	let errors = 0;
+	let warnings = 0;
+	let specsWithIssues = 0;
+	for (const r of results) {
+		const driftIssues = r.driftIssues ?? [];
+		if (driftIssues.length > 0) specsWithIssues++;
+		for (const issue of driftIssues) {
+			issues++;
+			if (issue.severity === "ERROR") errors++;
+			else if (issue.severity === "WARN") warnings++;
+		}
+	}
+	return {
+		issues,
+		errors,
+		warnings,
+		specsWithIssues
+	};
+}
 /**
 * A branch is a free-form label (e.g. `feature/foo`), stored verbatim and
 * never used to build a filesystem path, so `/` is allowed — only length is
@@ -11095,7 +11299,7 @@ const HTML_BODY = `
 
         <!-- Triage first: grading + learning is the most important action, so it
              sits above the spec list rather than being buried below it. -->
-        <div class="triage-head">
+        <div class="triage-head" id="triage-head">
           <h3 style="font-size:14px" data-i18n="detail.triage">Triage</h3>
           <span class="triage-summary" id="triage-summary"></span>
         </div>
@@ -11430,7 +11634,16 @@ const CSS = `
   .badge-det { background: var(--surface-3); color: var(--muted); border-color: var(--border); }
   .badge.drift-warn { background: var(--amber-bg); color: var(--amber); border-color: var(--amber-border); }
   .badge.drift-warn .d { background: var(--amber); }
+  .badge-drift { background: var(--violet-bg); color: var(--violet); border-color: var(--violet-border); }
   .chip { display: inline-flex; align-items: center; padding: 1px 8px; border-radius: 6px; background: var(--surface-3); border: 1px solid var(--border); color: var(--fg-dim); font-size: 12px; font-family: var(--mono); }
+  /* Below .chip in source order so these override its background/border/color
+     when combined as class="chip drift-*-chip" (same specificity — source
+     order decides). */
+  .chip.kind-chip { color: var(--violet); background: var(--violet-bg); border-color: var(--violet-border); font-family: var(--font); margin-left: 6px; }
+  .chip.drift-count-chip { color: var(--amber); background: var(--amber-bg); border-color: var(--amber-border); margin-left: 6px; }
+  .chip.drift-errors-chip { color: var(--fail); background: var(--fail-bg); border-color: var(--fail-border); margin-left: 6px; }
+  .drift-meta-box { display: flex; flex-direction: column; gap: 4px; }
+  .drift-meta-chips { display: flex; gap: 6px; }
   .specs { display: inline-flex; align-items: center; gap: 9px; }
   .meter { width: 54px; height: 6px; border-radius: 3px; background: var(--fail-bg); overflow: hidden; }
   .meter i { display: block; height: 100%; background: var(--pass); }
@@ -11519,6 +11732,7 @@ const CSS = `
   .drift-step { font-family: var(--mono); font-size: 11px; color: var(--muted-2); }
   .drift-msg { margin-top: 4px; color: var(--fg-dim); }
   .drift-detail { margin-top: 3px; color: var(--muted); font-size: 12px; }
+  .drift-clean { color: var(--pass); font-size: 13px; }
 
   /* triage grading — an explicit question + a segmented single-select, framed
      as an action ("tell us the real cause"), not a data readout. */
@@ -11724,12 +11938,17 @@ const CLIENT_JS = `
       "detail.triage": "Triage",
       "meta.branch": "Branch", "meta.specs": "Specs", "meta.prompt": "Prompt",
       "meta.created": "Created", "meta.passed": "passed", "meta.profile": "Profile",
+      "meta.drift": "Drift",
       "rec.title": "Recommendation",
       "acc.reasoning": "Reasoning", "acc.evidence": "Evidence", "acc.steps": "Live run steps",
       "acc.assertions": "Assertions", "acc.drift": "Drift audit",
       "acc.assertions.hint": "Test cases from the recorded spec run",
       "spec.kind.live": "Live", "spec.kind.det": "Deterministic",
       "spec.driftWarn": "Spec drift", "det.steps": "Steps",
+      "kind.run": "Test run", "kind.drift": "Drift audit",
+      "drift.summary.issues": "Issues", "drift.summary.errors": "Errors",
+      "drift.summary.warnings": "Warnings", "drift.summary.specsWithIssues": "Specs with issues",
+      "drift.clean": "No drift issues",
       "grade.question": "What was the real cause?", "grade.predicted": "predicted",
       "grade.ungraded": "ungraded", "grade.matches": "saved · matches",
       "grade.corrected": "saved · corrected", "grade.saving": "saving…",
@@ -11785,12 +12004,17 @@ const CLIENT_JS = `
       "detail.triage": "トリアージ",
       "meta.branch": "ブランチ", "meta.specs": "スペック", "meta.prompt": "プロンプト",
       "meta.created": "作成", "meta.passed": "合格", "meta.profile": "プロファイル",
+      "meta.drift": "ドリフト",
       "rec.title": "推奨対応",
       "acc.reasoning": "推論", "acc.evidence": "根拠", "acc.steps": "実行ステップ",
       "acc.assertions": "アサーション", "acc.drift": "ドリフト監査",
       "acc.assertions.hint": "記録したスペック実行のテストケース",
       "spec.kind.live": "ライブ", "spec.kind.det": "決定的",
       "spec.driftWarn": "仕様ドリフト", "det.steps": "ステップ",
+      "kind.run": "テスト実行", "kind.drift": "ドリフト監査",
+      "drift.summary.issues": "問題数", "drift.summary.errors": "エラー",
+      "drift.summary.warnings": "警告", "drift.summary.specsWithIssues": "問題のあるスペック",
+      "drift.clean": "ドリフトの問題なし",
       "grade.question": "実際の原因は何でしたか？", "grade.predicted": "予測",
       "grade.ungraded": "未評価", "grade.matches": "保存済み · 一致",
       "grade.corrected": "保存済み · 修正", "grade.saving": "保存中…",
@@ -12170,6 +12394,19 @@ const CLIENT_JS = `
       runCell.appendChild(el("div", "runid", r.id.slice(0, 8)));
       var sub = el("div", "subline");
       sub.appendChild(ciBadge(r));
+      if (r.kind === "drift") {
+        sub.appendChild(el("span", "chip kind-chip", t("kind.drift")));
+        if (r.drift) {
+          if (r.drift.errors > 0) {
+            sub.appendChild(el("span", "chip drift-errors-chip", t("drift.summary.errors") + " " + r.drift.errors));
+          }
+          if (r.drift.warnings > 0) {
+            sub.appendChild(el("span", "chip drift-count-chip", t("drift.summary.warnings") + " " + r.drift.warnings));
+          }
+        }
+      } else {
+        sub.appendChild(el("span", "chip kind-chip", t("kind.run")));
+      }
       runCell.appendChild(sub);
       tr.appendChild(runCell);
 
@@ -12245,7 +12482,29 @@ const CLIENT_JS = `
     metaItem(t("meta.branch"), branchChip);
     // Which environment the run executed against (recorded at push, display-only).
     if (run.profile) metaItem(t("meta.profile"), el("span", "chip", run.profile));
-    metaItem(t("meta.specs"), run.specs.passed + " / " + run.specs.total + " " + t("meta.passed"));
+    if (run.kind === "drift" && run.drift) {
+      // Drift runs have no live/deterministic spec pass count. Errors/warnings
+      // are the actionable counts and get colored chips; issues/specsWithIssues
+      // are supplementary totals shown as a muted line below.
+      if (run.drift.errors === 0 && run.drift.warnings === 0) {
+        metaItem(t("meta.drift"), el("div", "drift-clean", t("drift.clean")));
+      } else {
+        var driftBox = el("div", "drift-meta-box");
+        var chips = el("div", "drift-meta-chips");
+        if (run.drift.errors > 0) {
+          chips.appendChild(el("span", "chip drift-errors-chip", t("drift.summary.errors") + " " + run.drift.errors));
+        }
+        if (run.drift.warnings > 0) {
+          chips.appendChild(el("span", "chip drift-count-chip", t("drift.summary.warnings") + " " + run.drift.warnings));
+        }
+        driftBox.appendChild(chips);
+        var driftSub = el("div", "muted", t("drift.summary.specsWithIssues") + " " + run.drift.specsWithIssues + " / " + t("drift.summary.issues") + " " + run.drift.issues);
+        driftBox.appendChild(driftSub);
+        metaItem(t("meta.drift"), driftBox);
+      }
+    } else {
+      metaItem(t("meta.specs"), run.specs.passed + " / " + run.specs.total + " " + t("meta.passed"));
+    }
     metaItem(t("meta.prompt"), run.promptVersion || "—");
     metaItem(t("meta.created"), relTime(run.createdAt));
     head.appendChild(meta);
@@ -12583,7 +12842,7 @@ const CLIENT_JS = `
     return wrap;
   }
 
-  function renderSpecCard(runId, r, triageState) {
+  function renderSpecCard(runId, r, triageState, isDrift) {
     var card = el("div", "spec-card " + r.status); // .passed / .failed rail
     var head = el("div", "spec-card-head");
     var nameBlock = el("div");
@@ -12591,7 +12850,10 @@ const CLIENT_JS = `
     nameBlock.appendChild(el("div", "slug", r.feature + " / " + r.spec));
     head.appendChild(nameBlock);
     head.appendChild(el("div", "spacer"));
-    head.appendChild(r.liveRun ? el("span", "badge-live", t("spec.kind.live")) : el("span", "badge-det", t("spec.kind.det")));
+    head.appendChild(
+      isDrift ? el("span", "badge badge-drift", t("kind.drift"))
+              : (r.liveRun ? el("span", "badge-live", t("spec.kind.live"))
+                           : el("span", "badge-det", t("spec.kind.det"))));
     head.appendChild(statusBadge(r.status));
     var hasDriftError = r.driftIssues && r.driftIssues.some(function (d) { return d.severity === "ERROR"; });
     if (hasDriftError) {
@@ -12605,6 +12867,11 @@ const CLIENT_JS = `
     var body = el("div", "spec-card-body");
     var any = false;
 
+    if (isDrift && (!r.driftIssues || r.driftIssues.length === 0)) {
+      body.appendChild(el("div", "drift-clean", t("drift.clean")));
+      any = true;
+    }
+
     if (r.status === "failed" && r.analysis) {
       // Tier2: the verdict block (analysis) + the grading action, always shown.
       body.appendChild(analysisSection(runId, r));
@@ -12651,10 +12918,10 @@ const CLIENT_JS = `
     return card;
   }
 
-  function renderSpecCards(runId, results, triageState) {
+  function renderSpecCards(runId, results, triageState, isDrift) {
     var container = document.getElementById("spec-cards");
     clear(container);
-    results.forEach(function (r) { container.appendChild(renderSpecCard(runId, r, triageState)); });
+    results.forEach(function (r) { container.appendChild(renderSpecCard(runId, r, triageState, isDrift)); });
     document.getElementById("detail-spec-count").textContent = "· " + results.length;
   }
 
@@ -12791,9 +13058,14 @@ const CLIENT_JS = `
       // triage loads so the saved grades restore. Keeping these separate means
       // a triage failure (or a throw while rendering cards) can't be mislabelled
       // as the other, and neither escapes its own catch.
-      renderSpecCards(runId, report.results, { byKey: {} });
+      var isDrift = report.kind === "drift";
+      document.getElementById("triage-head").hidden = isDrift;
+      document.getElementById("matrix-card").hidden = isDrift;
+      document.getElementById("triage-progress").hidden = isDrift;
+      renderSpecCards(runId, report.results, { byKey: {} }, isDrift);
+      if (isDrift) return; // drift runs have no triage: skip loadTriage entirely
       loadTriage(runId, function (triageState) {
-        renderSpecCards(runId, report.results, triageState);
+        renderSpecCards(runId, report.results, triageState, isDrift);
       });
     }).catch(detailError("Error loading report"));
   }

package/dist/hub-client/index.d.mts

@@ -31,6 +31,16 @@ declare const RunSchema: z.ZodObject<{
     passed: "passed";
     failed: "failed";
   }>;
+  kind: z.ZodDefault<z.ZodEnum<{
+    run: "run";
+    drift: "drift";
+  }>>;
+  drift: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+    issues: z.ZodNumber;
+    errors: z.ZodNumber;
+    warnings: z.ZodNumber;
+    specsWithIssues: z.ZodNumber;
+  }, z.core.$strip>>>;
   specs: z.ZodObject<{
     total: z.ZodNumber;
     passed: z.ZodNumber;
@@ -171,6 +181,12 @@ type LabelsExport = z.infer<typeof LabelsExportSchema>;
 interface HubClientOptions {
   baseUrl: string;
   token: string;
+  /**
+   * Extra headers sent on every request, ahead of any per-call headers and
+   * the `Authorization` header (e.g. an infra gateway/ALB bypass header in
+   * CI — never overrides `Authorization`).
+   */
+  headers?: Record<string, string>;
   /** Override for testing; defaults to the global `fetch`. */
   fetchImpl?: typeof fetch;
 }
@@ -197,6 +213,7 @@ interface HubClient {
     project: string;
     branch?: string;
     profile?: string;
+    kind?: "run" | "drift";
   }): Promise<Run>;
   listRuns(q?: {
     project?: string;

package/dist/hub-client/index.mjs

@@ -51,6 +51,7 @@ function createHubClient(opts) {
 					...init,
 					signal,
 					headers: {
+						...opts.headers,
 						...init.headers,
 						Authorization: `Bearer ${opts.token}`
 					}
@@ -96,6 +97,7 @@ function createHubClient(opts) {
 			const params = new URLSearchParams({ project: meta.project });
 			if (meta.branch) params.set("branch", meta.branch);
 			if (meta.profile) params.set("profile", meta.profile);
+			if (meta.kind) params.set("kind", meta.kind);
 			return json(`/api/v1/runs?${params}`, {
 				method: "POST",
 				headers: { "Content-Type": "application/gzip" },

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {