ccqa 1.48.1 → 1.49.0

package/dist/bin/ccqa.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as bracedRefsToJsExpression, A as progressEnd, B as isExpandedActionStep, C as error, D as info, E as hint, F as withBuffer, G as tryParseTestSpec, H as isJudgeBody, I as CREDENTIAL_ENV_KEYS, J as SessionNameSchema, K as AGENT_BROWSER_TARGET, L as collectIncludedBlockNames, M as step, N as timedPhase, O as meta, P as warn, Q as isParamRequired, R as expandActionSteps, S as emitRaw, T as header, U as parseBlockSpec, V as isExpandedJudgeByLlmStep, W as parseTestSpec, X as TargetIdSchema, Y as SpecModeSchema, Z as isIncludeStep, _ as buildSpecEnvScrub, a as truncate$2, b as promoteMarkedAssert, c as toAgentBrowserArgs, d as surfaceAxisAside, et as envRefsToJsExpression, f as surfaceDefinitionBlock, g as buildProseEnvScrubMap, h as withCostTally, i as isObject, j as run, k as progress, l as numberLines, m as readCostTally, n as diagnose, nt as resolveEnvRefs, o as describeLocator, p as invokeClaudeStreaming, q as DEFAULT_SPEC_MODE, r as extractJsonCandidates, s as locatorToSelector, t as clamp, tt as iterEnvRefNames, u as outputLanguageBlock, v as scrubEnvValues, w as fix, x as blank, y as parseAbActionLine, z as expandSpec } from "../diagnose-CSQzwS5f.mjs";
+import { $ as isIncludeStep, A as meta, B as expandActionSteps, C as blank, D as header, E as fix, F as timedPhase, G as parseBlockSpec, H as isExpandedActionStep, I as warn, J as AGENT_BROWSER_TARGET, K as parseTestSpec, L as withBuffer, M as progressEnd, N as run, O as hint, P as step, Q as TargetIdSchema, R as CREDENTIAL_ENV_KEYS, S as promoteMarkedAssert, T as error, U as isExpandedJudgeByLlmStep, V as expandSpec, W as isJudgeBody, X as SessionNameSchema, Y as DEFAULT_SPEC_MODE, Z as SpecModeSchema, _ as scrubUnstableActions, a as truncate$2, b as scrubEnvValues, c as toAgentBrowserArgs, d as surfaceAxisAside, et as isParamRequired, f as surfaceDefinitionBlock, g as formatUnstableDrop, h as withCostTally, i as isObject, it as resolveEnvRefs, j as progress, k as info, l as numberLines, m as readCostTally, n as diagnose, nt as envRefsToJsExpression, o as describeLocator, p as invokeClaudeStreaming, q as tryParseTestSpec, r as extractJsonCandidates, rt as iterEnvRefNames, s as locatorToSelector, t as clamp, tt as bracedRefsToJsExpression, u as outputLanguageBlock, v as buildProseEnvScrubMap, w as emitRaw, x as parseAbActionLine, y as buildSpecEnvScrub, z as collectIncludedBlockNames } from "../diagnose-CZms9Cer.mjs";
 import { HubApiError, createHubClient, hubRequest } from "../hub-client/index.mjs";
 import { t as EVIDENCE_DIR_ENV } from "../evidence-constants-Cm_S_5od.mjs";
 import { a as formatAgentBrowserUnavailableMessage, i as assertAgentBrowserAvailable, n as spawnAB, o as pathWithAgentBrowserShim, r as AgentBrowserUnavailableError, s as resolveAgentBrowserBin$1, t as sleepSync } from "../spawn-ab-CR_Sr7wh.mjs";
@@ -23,6 +23,7 @@ import { connect as connect$1 } from "node:tls";
 import { gunzipSync, gzipSync } from "node:zlib";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface as createInterface$1 } from "node:readline";
+import { pipeline } from "node:stream/promises";
 //#region src/run/report-constants.ts
 /**
 * Pure report/run constants with no runtime dependencies. Kept separate from
@@ -17062,149 +17063,6 @@ function isPassiveAction(action) {
 	return action === "snapshot" || action === "wait" || action === "assert";
 }
 //#endregion
-//#region src/runtime/literal-scrub.ts
-/**
-* Patterns are listed in roughly descending confidence — a hit on `clock-hms`
-* is almost certainly bad; a hit on `unix-epoch-sec` (`1[0-9]{9}`) gates on
-* the value starting with `1`, which empirically rules out most SKU / order-id
-* false positives while still catching epoch seconds in the 2001-2033 window.
-*
-* Relative-time labels ("just now", "N minutes ago", "N分前") are the same
-* class of problem as wall-clock literals: the page shows them, Claude
-* captures them, and they're stale before the test ever replays. We only
-* catch the unambiguous variants — bare "now" or "minute" would false-fire
-* on routine UI copy.
-*/
-const UNSTABLE_PATTERNS = [
-	{
-		id: "clock-hms",
-		pattern: /\b\d{2}:\d{2}:\d{2}\b/,
-		label: "clock time HH:MM:SS"
-	},
-	{
-		id: "iso-datetime",
-		pattern: /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/,
-		label: "ISO datetime"
-	},
-	{
-		id: "iso-date",
-		pattern: /\b\d{4}-\d{2}-\d{2}\b/,
-		label: "ISO date YYYY-MM-DD"
-	},
-	{
-		id: "unix-epoch-sec",
-		pattern: /\b1[0-9]{9}\b/,
-		label: "Unix epoch seconds"
-	},
-	{
-		id: "unix-epoch-ms",
-		pattern: /\b1[0-9]{12}\b/,
-		label: "Unix epoch milliseconds"
-	},
-	{
-		id: "relative-time-en",
-		pattern: /\b\d+\s+(second|minute|hour|day|week|month|year)s?\s+ago\b/i,
-		label: "English relative time (`N <unit> ago`)"
-	},
-	{
-		id: "relative-now-en",
-		pattern: /\bjust\s+now\b/i,
-		label: "English `just now`"
-	},
-	{
-		id: "relative-time-ja",
-		pattern: /\d+\s*(秒|分|時間|日|週間|か月|ヶ月|年)前/,
-		label: "Japanese relative time (`N<unit>前`)"
-	},
-	{
-		id: "relative-now-ja",
-		pattern: /たった今/,
-		label: "Japanese `たった今`"
-	},
-	{
-		id: "ja-date-full",
-		pattern: /\d{4}年\d{1,2}月\d{1,2}日/,
-		label: "Japanese date YYYY年M月D日"
-	},
-	{
-		id: "ja-date-md",
-		pattern: /(?<!年)(?<!\d)\d{1,2}月\d{1,2}日(?![間目])/,
-		label: "Japanese date M月D日"
-	}
-];
-/**
-* Inspect a single action and return every (field, pattern) pair that
-* fired. An empty array means the action is safe to keep.
-*/
-function detectUnstableLiterals(action) {
-	const fields = [
-		["locator.value", action.locator?.value],
-		["locator.name", action.locator?.by === "role" ? action.locator.name : void 0],
-		["target.value", action.target?.value],
-		["value", action.value],
-		["label", action.label],
-		["observation", action.observation]
-	];
-	const hits = [];
-	for (const [field, raw] of fields) {
-		if (typeof raw !== "string" || raw.length === 0) continue;
-		for (const p of UNSTABLE_PATTERNS) {
-			const m = raw.match(p.pattern);
-			if (m) hits.push({
-				field,
-				patternId: p.id,
-				match: m[0]
-			});
-		}
-	}
-	return hits;
-}
-/**
-* Walk every recorded action and split it into kept / dropped buckets. A
-* `snapshot` action is treated specially: its `observation` field is just a
-* comment in the generated script, so we keep the action even if its
-* `observation` carries an unstable literal — the comment will be wrong but
-* the script will still run. All other actions get dropped on any hit
-* because their locator / `value` would otherwise drive an unreproducible
-* interaction.
-*/
-function scrubUnstableActions(actions) {
-	const kept = [];
-	const dropped = [];
-	for (let i = 0; i < actions.length; i++) {
-		const action = actions[i];
-		const hits = detectUnstableLiterals(action);
-		if (hits.length === 0) {
-			kept.push(action);
-			continue;
-		}
-		if (action.action === "snapshot" && hits.every((h) => h.field === "observation")) {
-			kept.push(action);
-			continue;
-		}
-		dropped.push({
-			index: i,
-			action,
-			hits
-		});
-	}
-	return {
-		kept,
-		dropped
-	};
-}
-/**
-* Human-readable summary of one drop, suitable for `log.warn`. The format
-* mirrors `replay-validate`'s drop line so both sources of warnings look
-* uniform in the trace output.
-*/
-function formatUnstableDrop(drop) {
-	const { action, hits } = drop;
-	const ids = [...new Set(hits.map((h) => h.patternId))].join(", ");
-	const samples = hits.map((h) => `${h.field}="${h.match}"`).join(", ");
-	return `${`${action.action}${action.assert ? " " + action.assert : ""}`}: contains unstable literal (${ids}) — ${samples}`;
-}
-//#endregion
 //#region src/cli/trace.ts
 /**
 * Step ids (in spec order) whose kept actions include no assertion. A step
@@ -29546,7 +29404,7 @@ const PRUNE_AGE_SLACK_MS = 3600 * 1e3;
 * event per line, appended in place (not atomic-rewritten — an append must
 * not cost the whole stream). A reader can therefore observe a partial final
 * line mid-append; the read side counts such lines as skipped rather than
-* failing, and the prune's full rewrite goes through the atomic path.
+* failing, and the prune's full rewrite goes through a temp file + rename.
 */
 function createFileCoverageEventStore(root, caps) {
 	const maxEvents = caps?.maxEvents ?? 2e5;
@@ -29558,15 +29416,15 @@ function createFileCoverageEventStore(root, caps) {
 	async function loadState(project, path) {
 		const cached = states.get(project);
 		if (cached) return cached;
-		const raw = await readRaw(path);
+		const tail = await statTail(path);
 		const state = {
 			nextSeq: 1,
 			count: 0,
-			bytes: Buffer.byteLength(raw),
+			bytes: tail?.size ?? 0,
 			oldestAt: null,
-			endsWithNewline: raw === "" || raw.endsWith("\n")
+			endsWithNewline: tail?.endsWithNewline ?? true
 		};
-		for (const rawLine of raw.split("\n")) {
+		for await (const rawLine of streamLines(path)) {
 			const line = parseLine(rawLine);
 			if (line === null) continue;
 			if (line.seq >= state.nextSeq) state.nextSeq = line.seq + 1;
@@ -29581,18 +29439,39 @@ function createFileCoverageEventStore(root, caps) {
 		const overBytes = state.bytes > maxBytes;
 		const overAge = state.oldestAt !== null && state.oldestAt < now - retentionMs - PRUNE_AGE_SLACK_MS;
 		if (!overCount && !overBytes && !overAge) return;
-		const lines = await readLines(path);
 		const cutoff = now - retentionMs;
-		const fresh = lines.filter((l) => l.at >= cutoff);
+		const freshSizes = [];
+		for await (const line of streamFreshLines(path, cutoff)) freshSizes.push(Buffer.byteLength(JSON.stringify(line)) + 1);
 		const keep = overCount ? Math.max(0, maxEvents - pruneBatch) : maxEvents;
-		let kept = fresh.length > keep ? fresh.slice(fresh.length - keep) : fresh;
-		if (overBytes) kept = newestWithinBytes(kept, pruneBytesTarget);
-		const encoded = new TextEncoder().encode(kept.map((l) => JSON.stringify(l)).join("\n") + (kept.length > 0 ? "\n" : ""));
-		await writeBytes(path, encoded);
-		const dropped = state.count - kept.length;
-		state.count = kept.length;
-		state.bytes = encoded.byteLength;
-		state.oldestAt = kept[0]?.at ?? null;
+		let firstKept = freshSizes.length > keep ? freshSizes.length - keep : 0;
+		if (overBytes) firstKept = firstWithinBytes(freshSizes, firstKept, pruneBytesTarget);
+		await mkdir(dirname(path), { recursive: true });
+		const tmp = `${path}.${randomUUID()}.tmp`;
+		let keptCount = 0;
+		let keptBytes = 0;
+		let oldestKeptAt = null;
+		try {
+			await pipeline(async function* () {
+				let freshIdx = 0;
+				for await (const line of streamFreshLines(path, cutoff)) {
+					freshIdx += 1;
+					if (freshIdx <= firstKept) continue;
+					const text = JSON.stringify(line) + "\n";
+					keptCount += 1;
+					keptBytes += Buffer.byteLength(text);
+					if (oldestKeptAt === null) oldestKeptAt = line.at;
+					yield text;
+				}
+			}, createWriteStream(tmp, { encoding: "utf8" }));
+		} catch (err) {
+			await rm(tmp, { force: true });
+			throw err;
+		}
+		await rename(tmp, path);
+		const dropped = state.count - keptCount;
+		state.count = keptCount;
+		state.bytes = keptBytes;
+		state.oldestAt = oldestKeptAt;
 		state.endsWithNewline = true;
 		if (dropped > 0) console.warn(`hub: coverage inbox for "${project}": dropped ${dropped} events past retention (${maxEvents} events / ${Math.round(maxBytes / 1048576)} MiB / ${Math.round(retentionMs / 864e5)} days)`);
 	}
@@ -29661,22 +29540,46 @@ function createFileCoverageEventStore(root, caps) {
 		}
 	};
 }
-/** The longest tail of `lines` whose serialized size (newlines included) fits in `budget`. */
-function newestWithinBytes(lines, budget) {
-	let total = 0;
-	for (let i = lines.length - 1; i >= 0; i -= 1) {
-		total += Buffer.byteLength(JSON.stringify(lines[i])) + 1;
-		if (total > budget) return lines.slice(i + 1);
-	}
-	return lines;
-}
-async function readRaw(path) {
+/** Size and trailing-newline state of the stream file, or null when it doesn't exist. */
+async function statTail(path) {
+	let fh;
 	try {
-		return await readFile(path, "utf8");
+		fh = await open(path, "r");
 	} catch (err) {
-		if (err instanceof Error && "code" in err && err.code === "ENOENT") return "";
+		if (isNotFound(err)) return null;
 		throw err;
 	}
+	try {
+		const { size } = await fh.stat();
+		if (size === 0) return {
+			size,
+			endsWithNewline: true
+		};
+		const tail = Buffer.alloc(1);
+		await fh.read(tail, 0, 1, size - 1);
+		return {
+			size,
+			endsWithNewline: tail[0] === 10
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/** Retention-window lines only, in file order (= append order = seq order). */
+async function* streamFreshLines(path, cutoff) {
+	for await (const rawLine of streamLines(path)) {
+		const line = parseLine(rawLine);
+		if (line !== null && line.at >= cutoff) yield line;
+	}
+}
+/** Start of the longest suffix of `sizes` that fits `budget` (never below `lower`). */
+function firstWithinBytes(sizes, lower, budget) {
+	let total = 0;
+	for (let i = sizes.length - 1; i >= lower; i -= 1) {
+		total += sizes[i];
+		if (total > budget) return i + 1;
+	}
+	return lower;
 }
 /**
 * The stream's non-empty lines, one at a time. Streamed rather than read as one
@@ -29693,21 +29596,12 @@ async function* streamLines(path) {
 	try {
 		for await (const line of lines) if (line !== "") yield line;
 	} catch (err) {
-		if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) throw err;
+		if (!isNotFound(err)) throw err;
 	} finally {
 		lines.close();
 		input.destroy();
 	}
 }
-/** Every parseable line of the log; partial or corrupt lines are silently omitted (the read side counts them). */
-async function readLines(path) {
-	const lines = [];
-	for await (const rawLine of streamLines(path)) {
-		const line = parseLine(rawLine);
-		if (line !== null) lines.push(line);
-	}
-	return lines;
-}
 function parseLine(rawLine) {
 	let value;
 	try {

package/dist/{diagnose-CSQzwS5f.mjs → diagnose-CZms9Cer.mjs}

@@ -966,6 +966,189 @@ function scrubEnvValues(text, scrubMap) {
 	return out;
 }
 //#endregion
+//#region src/runtime/literal-scrub.ts
+/**
+* Patterns are listed in roughly descending confidence — a hit on `clock-hms`
+* is almost certainly bad; a hit on `unix-epoch-sec` (`1[0-9]{9}`) gates on
+* the value starting with `1`, which empirically rules out most SKU / order-id
+* false positives while still catching epoch seconds in the 2001-2033 window.
+*
+* Relative-time labels ("just now", "N minutes ago", "N分前") are the same
+* class of problem as wall-clock literals: the page shows them, Claude
+* captures them, and they're stale before the test ever replays. We only
+* catch the unambiguous variants — bare "now" or "minute" would false-fire
+* on routine UI copy.
+*/
+const UNSTABLE_PATTERNS = [
+	{
+		id: "clock-hms",
+		pattern: /\b\d{2}:\d{2}:\d{2}\b/,
+		label: "clock time HH:MM:SS"
+	},
+	{
+		id: "iso-datetime",
+		pattern: /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/,
+		label: "ISO datetime"
+	},
+	{
+		id: "iso-date",
+		pattern: /\b\d{4}-\d{2}-\d{2}\b/,
+		label: "ISO date YYYY-MM-DD"
+	},
+	{
+		id: "unix-epoch-sec",
+		pattern: /\b1[0-9]{9}\b/,
+		label: "Unix epoch seconds"
+	},
+	{
+		id: "unix-epoch-ms",
+		pattern: /\b1[0-9]{12}\b/,
+		label: "Unix epoch milliseconds"
+	},
+	{
+		id: "relative-time-en",
+		pattern: /\b\d+\s+(second|minute|hour|day|week|month|year)s?\s+ago\b/i,
+		label: "English relative time (`N <unit> ago`)"
+	},
+	{
+		id: "relative-now-en",
+		pattern: /\bjust\s+now\b/i,
+		label: "English `just now`"
+	},
+	{
+		id: "relative-time-ja",
+		pattern: /\d+\s*(秒|分|時間|日|週間|か月|ヶ月|年)前/,
+		label: "Japanese relative time (`N<unit>前`)"
+	},
+	{
+		id: "relative-now-ja",
+		pattern: /たった今/,
+		label: "Japanese `たった今`"
+	},
+	{
+		id: "ja-date-full",
+		pattern: /\d{4}年\d{1,2}月\d{1,2}日/,
+		label: "Japanese date YYYY年M月D日"
+	},
+	{
+		id: "ja-date-md",
+		pattern: /(?<!年)(?<!\d)\d{1,2}月\d{1,2}日(?![間目])/,
+		label: "Japanese date M月D日"
+	}
+];
+/**
+* Opaque machine-generated id shapes. Only the unambiguous forms are listed:
+* long digit or hex runs also appear in addresses a step legitimately names
+* (a date path, a numeric tenant id, a content hash), and a false hit here
+* dead-ends that step — the guard in `claude/invoke.ts` blocks the `open`
+* and the navigate check below drops the action. A missed id still fails
+* verification at record time, so the trade is deliberate.
+*
+* Boundaries are alphanumeric lookarounds, not `\b`, so `item_01H8…`
+* (word-char `_`) is still caught; `i` accepts lowercase ULIDs (a 26-letter
+* lowercase run inside a URL is rare enough to risk). Ids that come from
+* `${ENV_VAR}` values are symbolised before either check runs, never match.
+*/
+const OPAQUE_ID_PATTERNS = [{
+	id: "ulid",
+	pattern: /(?<![0-9A-Za-z])[0-9A-HJKMNP-TV-Z]{26}(?![0-9A-Za-z])/i,
+	label: "ULID"
+}, {
+	id: "uuid",
+	pattern: /(?<![0-9A-Za-z])[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?![0-9A-Za-z])/i,
+	label: "UUID"
+}];
+/** First opaque-id hit in `text`, or null. Also used by the `open` guard in `claude/invoke.ts`. */
+function findOpaqueIdSegment(text) {
+	for (const p of OPAQUE_ID_PATTERNS) {
+		const m = text.match(p.pattern);
+		if (m) return {
+			patternId: p.id,
+			match: m[0]
+		};
+	}
+	return null;
+}
+/**
+* Inspect a single action and return every (field, pattern) pair that
+* fired. An empty array means the action is safe to keep.
+*/
+function detectUnstableLiterals(action) {
+	const fields = [
+		["locator.value", action.locator?.value],
+		["locator.name", action.locator?.by === "role" ? action.locator.name : void 0],
+		["target.value", action.target?.value],
+		["value", action.value],
+		["label", action.label],
+		["observation", action.observation]
+	];
+	const hits = [];
+	if (action.action === "navigate" && typeof action.value === "string") {
+		const opaque = findOpaqueIdSegment(action.value);
+		if (opaque) hits.push({
+			field: "value",
+			...opaque
+		});
+	}
+	for (const [field, raw] of fields) {
+		if (typeof raw !== "string" || raw.length === 0) continue;
+		for (const p of UNSTABLE_PATTERNS) {
+			const m = raw.match(p.pattern);
+			if (m) hits.push({
+				field,
+				patternId: p.id,
+				match: m[0]
+			});
+		}
+	}
+	return hits;
+}
+/**
+* Walk every recorded action and split it into kept / dropped buckets. A
+* `snapshot` action is treated specially: its `observation` field is just a
+* comment in the generated script, so we keep the action even if its
+* `observation` carries an unstable literal — the comment will be wrong but
+* the script will still run. All other actions get dropped on any hit
+* because their locator / `value` would otherwise drive an unreproducible
+* interaction.
+*/
+function scrubUnstableActions(actions) {
+	const kept = [];
+	const dropped = [];
+	for (let i = 0; i < actions.length; i++) {
+		const action = actions[i];
+		const hits = detectUnstableLiterals(action);
+		if (hits.length === 0) {
+			kept.push(action);
+			continue;
+		}
+		if (action.action === "snapshot" && hits.every((h) => h.field === "observation")) {
+			kept.push(action);
+			continue;
+		}
+		dropped.push({
+			index: i,
+			action,
+			hits
+		});
+	}
+	return {
+		kept,
+		dropped
+	};
+}
+/**
+* Human-readable summary of one drop, suitable for `log.warn`. The format
+* mirrors `replay-validate`'s drop line so both sources of warnings look
+* uniform in the trace output.
+*/
+function formatUnstableDrop(drop) {
+	const { action, hits } = drop;
+	const ids = [...new Set(hits.map((h) => h.patternId))].join(", ");
+	const samples = hits.map((h) => `${h.field}="${h.match}"`).join(", ");
+	return `${`${action.action}${action.assert ? " " + action.assert : ""}`}: contains unstable literal (${ids}) — ${samples}`;
+}
+//#endregion
 //#region src/claude/native-binary.ts
 const require = createRequire(import.meta.url);
 /**
@@ -1190,6 +1373,11 @@ async function invokeClaudeStreaming(options, onEvent) {
 						decision: "block",
 						reason: "Do not suppress errors on `agent-browser` commands. Remove `|| true`, `|| :`, `2>/dev/null`, `; true`, and similar redirects so ccqa can detect failures and roll back unsuccessful attempts. Run the command standalone and let it surface its exit code."
 					};
+					const runProducedUrl = findRunProducedOpenUrl(cmd, envScrubMap);
+					if (runProducedUrl !== null) return {
+						decision: "block",
+						reason: `Do not open ${runProducedUrl} — that address was produced by this run (the id in it belongs to a record this run created), so the generated test would open a record later runs do not have. Reach the page the way a person does: click through from where the run already is. If the spec's instruction really names this exact address, put the id in a profile variable so it survives replay.`
+					};
 				}
 				const assertMarker = relaxAbConstraints ? null : extractCcqaAssertFromBashCommand(cmd);
 				const ab = relaxAbConstraints ? null : extractAbActionFromBashCommand(cmd) ?? (assertMarker !== null ? extractObservationAbAction(cmd) : null);
@@ -1338,14 +1526,22 @@ function shellTokenize(s) {
 	if (cur) tokens.push(cur);
 	return tokens;
 }
-/** Extracts the subcommand from an `agent-browser [flags] <subcommand> [args...]` command string. */
-function extractAbSubcommand(cmd) {
+/**
+* Positional tokens of an `agent-browser [flags] <subcommand> [args...]`
+* command string, value-taking flags dropped. Empty when `cmd` is not an
+* agent-browser call.
+*/
+function abPositionalTokens(cmd) {
 	const abIdx = cmd.indexOf("agent-browser");
-	if (abIdx === -1) return null;
+	if (abIdx === -1) return [];
 	const parts = shellTokenize(cmd.slice(abIdx + 13).trim());
 	let i = 0;
 	while (i < parts.length && parts[i].startsWith("-")) i += 2;
-	return parts[i] ?? null;
+	return parts.slice(i);
+}
+/** Extracts the subcommand from an `agent-browser [flags] <subcommand> [args...]` command string. */
+function extractAbSubcommand(cmd) {
+	return abPositionalTokens(cmd)[0] ?? null;
 }
 /** Returns true if the agent-browser subcommand is blocked (eval/js/find/etc). */
 function isBlockedAbSubcommand(cmd) {
@@ -1411,6 +1607,20 @@ function hasRefSelector(cmd) {
 	return false;
 }
 /**
+* Detect `agent-browser open <url>` whose address carries an opaque
+* machine-generated id (ULID / UUID) that no `${ENV_VAR}` value accounts
+* for. Such an address was produced by the run itself — this is the
+* mechanical form of the trace prompt's "Open only a URL the step names"
+* rule, which alone does not stop every model. Returns the env-scrubbed URL
+* for the block message, or null when the command is fine.
+*/
+function findRunProducedOpenUrl(cmd, envScrubMap) {
+	const [sub, url] = abPositionalTokens(cmd);
+	if (sub !== "open" || !url) return null;
+	const scrubbed = scrubEnvValues(url, envScrubMap);
+	return findOpaqueIdSegment(scrubbed) !== null ? scrubbed : null;
+}
+/**
 * Split `cmd` into shell statements at unquoted separators (`;`, `|`, `&`,
 * newline; consecutive separator chars like `&&` count once). String
 * literals are honoured so `fill "a;b"` stays a single statement. This is a
@@ -2219,4 +2429,4 @@ function clamp(n, lo, hi) {
 	return n;
 }
 //#endregion
-export { bracedRefsToJsExpression as $, progressEnd as A, isExpandedActionStep as B, error as C, info as D, hint as E, withBuffer as F, tryParseTestSpec as G, isJudgeBody as H, CREDENTIAL_ENV_KEYS as I, SessionNameSchema as J, AGENT_BROWSER_TARGET as K, collectIncludedBlockNames as L, step as M, timedPhase as N, meta as O, warn as P, isParamRequired as Q, expandActionSteps as R, emitRaw as S, header as T, parseBlockSpec as U, isExpandedJudgeByLlmStep as V, parseTestSpec as W, TargetIdSchema as X, SpecModeSchema as Y, isIncludeStep as Z, buildSpecEnvScrub as _, truncate as a, promoteMarkedAssert as b, toAgentBrowserArgs as c, surfaceAxisAside as d, envRefsToJsExpression as et, surfaceDefinitionBlock as f, buildProseEnvScrubMap as g, withCostTally as h, isObject as i, run as j, progress as k, numberLines as l, readCostTally as m, diagnose as n, resolveEnvRefs as nt, describeLocator as o, invokeClaudeStreaming as p, DEFAULT_SPEC_MODE as q, extractJsonCandidates as r, locatorToSelector as s, clamp as t, iterEnvRefNames as tt, outputLanguageBlock as u, scrubEnvValues as v, fix as w, blank as x, parseAbActionLine as y, expandSpec as z };
+export { isIncludeStep as $, meta as A, expandActionSteps as B, blank as C, header as D, fix as E, timedPhase as F, parseBlockSpec as G, isExpandedActionStep as H, warn as I, AGENT_BROWSER_TARGET as J, parseTestSpec as K, withBuffer as L, progressEnd as M, run as N, hint as O, step as P, TargetIdSchema as Q, CREDENTIAL_ENV_KEYS as R, promoteMarkedAssert as S, error as T, isExpandedJudgeByLlmStep as U, expandSpec as V, isJudgeBody as W, SessionNameSchema as X, DEFAULT_SPEC_MODE as Y, SpecModeSchema as Z, scrubUnstableActions as _, truncate as a, scrubEnvValues as b, toAgentBrowserArgs as c, surfaceAxisAside as d, isParamRequired as et, surfaceDefinitionBlock as f, formatUnstableDrop as g, withCostTally as h, isObject as i, resolveEnvRefs as it, progress as j, info as k, numberLines as l, readCostTally as m, diagnose as n, envRefsToJsExpression as nt, describeLocator as o, invokeClaudeStreaming as p, tryParseTestSpec as q, extractJsonCandidates as r, iterEnvRefNames as rt, locatorToSelector as s, clamp as t, bracedRefsToJsExpression as tt, outputLanguageBlock as u, buildProseEnvScrubMap as v, emitRaw as w, parseAbActionLine as x, buildSpecEnvScrub as y, collectIncludedBlockNames as z };

package/dist/hub-client/index.d.mts

@@ -35,9 +35,9 @@ declare const RunSchema: z.ZodObject<{
     running: "running";
   }>;
   kind: z.ZodDefault<z.ZodEnum<{
+    record: "record";
     run: "run";
     drift: "drift";
-    record: "record";
   }>>;
   drift: z.ZodDefault<z.ZodNullable<z.ZodObject<{
     specs: z.ZodNumber;
@@ -640,8 +640,8 @@ declare const ReportSpecResultSchema: z.ZodObject<{
   title: z.ZodNullable<z.ZodString>;
   target: z.ZodOptional<z.ZodString>;
   mode: z.ZodOptional<z.ZodEnum<{
-    live: "live";
     deterministic: "deterministic";
+    live: "live";
   }>>;
   status: z.ZodEnum<{
     passed: "passed";
@@ -811,9 +811,9 @@ type ReportSpecResult = z.infer<typeof ReportSpecResultSchema>;
 declare const RunReportDataSchema: z.ZodObject<{
   schemaVersion: z.ZodLiteral<1>;
   kind: z.ZodDefault<z.ZodEnum<{
+    record: "record";
     run: "run";
     drift: "drift";
-    record: "record";
   }>>;
   createdAt: z.ZodString;
   runId: z.ZodNullable<z.ZodString>;
@@ -854,8 +854,8 @@ declare const RunReportDataSchema: z.ZodObject<{
     title: z.ZodNullable<z.ZodString>;
     target: z.ZodOptional<z.ZodString>;
     mode: z.ZodOptional<z.ZodEnum<{
-      live: "live";
       deterministic: "deterministic";
+      live: "live";
     }>>;
     status: z.ZodEnum<{
       passed: "passed";

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.48.1",
+  "version": "1.49.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/dist/runtime/judge.mjs

@@ -1,4 +1,4 @@
-import { a as truncate, p as invokeClaudeStreaming, r as extractJsonCandidates } from "../diagnose-CSQzwS5f.mjs";
+import { a as truncate, p as invokeClaudeStreaming, r as extractJsonCandidates } from "../diagnose-CZms9Cer.mjs";
 //#region src/runtime/judge.ts
 const SYSTEM_PROMPT = [
 	"You decide whether a claim holds for a piece of text taken from a web page under test.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.48.1",
+  "version": "1.49.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {