ccqa 1.51.0 → 1.51.1

package/dist/bin/ccqa.mjs

@@ -11126,6 +11126,7 @@ ${stepsText}
 - Judge ONLY this step's \`Expected\` condition. Do not infer pass/fail from steps that have not run yet.
 - If the page shows an error banner, a 404, a login wall, or any blocker that prevents the expected outcome — fail.
 - If the expected outcome is partially satisfied (e.g. the page loaded but the asserted element is missing) — fail, and say which part is missing.
+- **An \`Expected\` may label its parts.** A \`must:\` line is the assertion — the rule above applies to it. A \`when present:\` line is observed, not required: judge it when it is there, and when it is absent say so in your reason and pass on the \`must:\` lines alone. Every line of a labelled \`Expected\` carries a label; text with no labels at all is all \`must:\`.
 - Pass only when you have *positive* evidence (a successful snapshot, a verified URL, a wait that resolved). "No error shown" is not enough on its own.
 - Do not invent success when blocked: fail honestly with a short reason.
 - **Evidence discipline**: when the assertion target is a specific row / message / banner / URL, scroll it into view (or focus the relevant pane) before letting the step end. The "after" screenshot is captured for you automatically — your job is to make sure that screenshot shows the thing your STEP_RESULT line is talking about.
@@ -12634,12 +12635,21 @@ function isStateSelector(selector) {
 function plainSelectorOf(action) {
 	return action.locator && action.index === void 0 ? locatorToSelector(action.locator) : void 0;
 }
+/**
+* A `wait` the post-trace validator actually ran and saw fail. Cascade-skipped
+* actions carry the flag without ever having been attempted, so they are not
+* evidence of anything and stay.
+*/
+function isProvenFailedWait(action) {
+	return action.replayUnstable === true && !(action.replayReason ?? "").includes("skipped after a preceding action failed");
+}
 function actionToLine$1(action) {
 	if (isRefSelector(plainSelectorOf(action))) return null;
 	if (action.action === "assert" && action.replayUnstable && typeof action.replayReason === "string" && action.replayReason.includes("selector not present")) {
 		const sel = plainSelectorOf(action) ?? action.observation ?? "(unknown)";
 		return `// [warn] replay-unstable: dropped over-assertion (${action.assert ?? "assert"} ${sel}) — selector not present on replay`;
 	}
+	if (action.action === "wait" && isProvenFailedWait(action)) return `// [warn] replay-unstable: dropped wait (${plainSelectorOf(action) ?? "(unknown)"}) — did not resolve on replay`;
 	switch (action.action) {
 		case "snapshot": return action.observation ? `// ${action.observation}` : null;
 		case "wait": {
@@ -13725,6 +13735,7 @@ function actionToLine(action) {
 		const sel = action.locator?.value ?? action.observation ?? "(unknown)";
 		return `// [warn] replay-unstable: dropped over-assertion (${action.assert ?? "assert"} ${sel}) — selector not present on replay`;
 	}
+	if (action.action === "wait" && action.replayUnstable === true && !(action.replayReason ?? "").includes("skipped after a preceding action failed")) return `// [warn] replay-unstable: dropped wait (${action.locator?.value ?? "(unknown)"}) — did not resolve on replay`;
 	const locator = action.locator ? locatorToPlaywright(action.locator, action.index) : null;
 	const subject = locator !== null && action.index === void 0 ? `${locator}.first()` : locator;
 	switch (action.action) {
@@ -16829,6 +16840,8 @@ CCQA_STEP=<step-id> CCQA_ASSERT=url_contains:/dashboard agent-browser --session
 
 - **Assert what the step asks about, nothing else.** The \`expected\` is the contract; anything else you happened to see on the way is not. A nav item, a heading or a greeting that the step never mentions adds no coverage, differs between recordings of the same spec, and is the first thing to break on replay — so the next recording quietly drops it and the test gets weaker without anyone deciding that.
 
+- **An \`expected\` that labels its parts is recorded down to the \`must:\` lines.** A \`when present:\` line names something the product does not produce on every run, so **nothing that fails on its absence may be recorded for it** — no assert, and no \`wait --text\` either: a recorded wait throws on the next run that legitimately lacks it, which is the same failure an assert would have caused. Look at it with \`snapshot\` or \`get count\` if you want to see it, and record nothing. When the step needs to wait for something asynchronous to arrive, anchor that wait on a \`must:\` signal — waiting on the optional one makes the whole step hinge on it. Every line of a labelled \`expected\` carries a label; text with no labels at all is all \`must:\`.
+
 - **\`url_contains\` is opt-in, not a habit.** The same rule, in the form that gets broken most. Emit it ONLY when a step's own \`expected\` explicitly asks about the URL or path. Do NOT add a \`url_contains\` to "prove" a login succeeded, a page loaded, or a navigation happened — confirm those with \`text_visible\` / \`element_visible\` on something the destination page renders. An unrequested URL assertion adds no coverage the visible-content assert doesn't already give, and is the single most common way an environment gets baked into a test.
 - **When you do assert a URL, the substring may come from ONE place only:** a \`\${VAR}\` URL that *this step's own instruction* opened, written as that \`\${VAR}\` followed by the literal tail after it. If the step opens \`\${APP_URL}/policies\`, assert \`\${APP_URL}/policies\` (or the tail \`/policies\`); the recorder resolves \`\${APP_URL}\` per environment. Never assert on a URL you merely *observed* — login redirects, identity-provider pages, and OAuth callbacks all live on a **different, environment-named origin** than the app, so any substring of them (host, origin, OR path) names the environment.
 - **A leading slash does NOT make a substring safe.** \`/auth-staging\`, \`/env-qa\`, \`/tenant-acme\` look like paths but are environment labels — the first segment of an identity-provider or tenant URL, not an application route. If a substring contains an environment name, a stage token (\`dev\`, \`stg\`, \`prod\`), a tenant/org name, or any fragment of a hostname, it is forbidden even with a leading slash. The only safe path substrings are stable *application* routes off the app's own origin (\`/dashboard\`, \`/policies/new\`), taken from a \`\${VAR}\` you opened — not from a redirect you watched.

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.51.0",
+  "version": "1.51.1",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.51.0",
+  "version": "1.51.1",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {