e2e 0.15.2 → 0.17.0

package/dist/run/provision.d.ts

@@ -103,4 +103,3 @@ export type ProcessHooks = () => ManagedProcessHooks;
  * aborted; what was acquired is returned for release either way.
  */
 export declare function startDeclaredProcesses(targets: readonly ResolvedTarget[], projectRoot: string, hooks: ProcessHooks, signal: AbortSignal, debug: DebugTrace, pool?: ProcessPool): Promise<AppProcesses>;
-//# sourceMappingURL=provision.d.ts.map

package/dist/run/provision.js

@@ -217,4 +217,3 @@ export async function startDeclaredProcesses(targets, projectRoot, hooks, signal
         throw cause;
     }
 }
-//# sourceMappingURL=provision.js.map

package/dist/run/realm.d.ts

@@ -33,7 +33,10 @@ export declare function findRegistered(realm: Realm, test: CollectedTest): Regis
 /**
  * Runs one hook, or a fixture teardown, within its budget. One that overruns
  * fails with the runner's timeout error naming `label`; `onTimeout` lets the
- * caller cancel what it started.
+ * caller cancel what it started. The hook owns the `expect.poll` calls it
+ * starts: one still running when it returns fails it with
+ * `STEP_NOT_AWAITED` and is cancelled, and one left by a hook that failed is
+ * cancelled beside that failure.
  */
 export declare function runHook(label: string, run: () => void | Promise<void>, timeoutMs: number, onTimeout?: () => void): Promise<void>;
 export interface RealmManagerOptions {
@@ -43,6 +46,8 @@ export interface RealmManagerOptions {
     readonly cleanupTimeout: number;
     /** Run-level error sink for hook failures. */
     readonly runErrors: RunError[];
+    /** What collection rewrites titles with (`collectModule`), so a realm's tests match the collected ids. */
+    readonly redactTitle: (title: string) => string;
     readonly debug?: DebugTrace;
 }
 /** Creates realms and runs suite-scope hooks with per-realm entry tracking. */
@@ -94,4 +99,3 @@ export declare class RealmManager {
     private suiteFixtures;
 }
 export {};
-//# sourceMappingURL=realm.d.ts.map

package/dist/run/realm.js

@@ -1,5 +1,6 @@
 /** Suite realm lifecycle: module re-import, beforeAll/afterAll scope tracking. */
 import { importModule } from '../config/load.js';
+import { PollScope, runInPollScope } from '../expect/poll-scope.js';
 import { classifyError, E2EError, serializeError, TestTimeoutError, } from '../internal/errors.js';
 import { DebugTrace } from '../internal/debug.js';
 import { titlePathKey } from '../internal/ids.js';
@@ -12,13 +13,26 @@ export function findRegistered(realm, test) {
 /**
  * Runs one hook, or a fixture teardown, within its budget. One that overruns
  * fails with the runner's timeout error naming `label`; `onTimeout` lets the
- * caller cancel what it started.
+ * caller cancel what it started. The hook owns the `expect.poll` calls it
+ * starts: one still running when it returns fails it with
+ * `STEP_NOT_AWAITED` and is cancelled, and one left by a hook that failed is
+ * cancelled beside that failure.
  */
-export function runHook(label, run, timeoutMs, onTimeout) {
-    return withTimeout(Promise.resolve().then(run), timeoutMs, () => {
-        onTimeout?.();
-        return new TestTimeoutError(`${label} timed out`);
-    });
+export async function runHook(label, run, timeoutMs, onTimeout) {
+    const polls = new PollScope(`the ${label}`);
+    try {
+        await withTimeout(runInPollScope(polls, () => Promise.resolve().then(run)), timeoutMs, () => {
+            onTimeout?.();
+            return new TestTimeoutError(`${label} timed out`);
+        });
+    }
+    catch (cause) {
+        polls.close();
+        throw cause;
+    }
+    const notAwaited = polls.close();
+    if (notAwaited !== undefined)
+        throw notAwaited;
 }
 /** Creates realms and runs suite-scope hooks with per-realm entry tracking. */
 export class RealmManager {
@@ -32,7 +46,7 @@ export class RealmManager {
     /** Re-imports one test module in a fresh realm. */
     async create(file) {
         this.realmCounter += 1;
-        const registration = await this.debug.time('realm.import', () => collectModule(() => importModule(file.absolutePath, `${this.options.targetName}-${this.realmCounter}`), file.absolutePath));
+        const registration = await this.debug.time('realm.import', () => collectModule(() => importModule(file.absolutePath, `${this.options.targetName}-${this.realmCounter}`), file.absolutePath, this.options.redactTitle));
         return this.adopt(registration, file);
     }
     /**
@@ -152,4 +166,3 @@ function scopeId(scope) {
 function scopeChainFor(test) {
     return [undefined, ...groupChain(test.group)];
 }
-//# sourceMappingURL=realm.js.map

package/dist/run/records.d.ts

@@ -148,9 +148,24 @@ export interface ResultRecord {
  * every other field is plain data.
  */
 export type WireResultRecord = Omit<ResultRecord, 'target'>;
+/** The failure a runtime skip followed, with the evidence its attempt captured. */
+export interface FailureBeforeSkip {
+    readonly error: SerializedError;
+    readonly failure: FailureEvidence | undefined;
+    /** The failing attempt's artifacts; for a serial member, the group attempt's. */
+    readonly artifacts: readonly ArtifactRecord[];
+}
+/**
+ * The failure a test's `test.skip(...)` followed: the last attempt that
+ * failed before a skipped retry, or a soft failure the skipping attempt kept.
+ * Engine cleanup diagnostics after the skip are not one. A serial member's
+ * attempts live on its group, which `groupOf` looks up only for such a member.
+ */
+export declare function failureBeforeSkip(result: Pick<ResultRecord, 'status' | 'skip' | 'attempts' | 'serialGroupId' | 'test'>, groupOf: (id: string) => SerialGroupRecord | undefined): FailureBeforeSkip | undefined;
+/** Whether any skipped result followed a failure: what `failOnSkippedFailure` fails a run for. */
+export declare function someSkippedAfterFailure(results: readonly ResultRecord[], serialGroups: readonly SerialGroupRecord[]): boolean;
 /** Strips the live target from a result for transport. */
 export declare function encodeResult(record: ResultRecord): WireResultRecord;
 export interface RunError {
     error: SerializedError;
 }
-//# sourceMappingURL=records.d.ts.map

package/dist/run/records.js

@@ -7,9 +7,34 @@
 export function isFailedStatus(status) {
     return status !== 'passed' && status !== 'skipped' && status !== 'flaky';
 }
+/**
+ * The failure a test's `test.skip(...)` followed: the last attempt that
+ * failed before a skipped retry, or a soft failure the skipping attempt kept.
+ * Engine cleanup diagnostics after the skip are not one. A serial member's
+ * attempts live on its group, which `groupOf` looks up only for such a member.
+ */
+export function failureBeforeSkip(result, groupOf) {
+    if (result.status !== 'skipped' || result.skip?.cause !== 'explicit')
+        return undefined;
+    const runs = result.serialGroupId === undefined
+        ? result.attempts
+        : (groupOf(result.serialGroupId)?.attempts ?? []).flatMap((attempt) => attempt.members
+            .filter((member) => member.testId === result.test.id)
+            .map((member) => ({ ...member, artifacts: attempt.artifacts })));
+    for (const run of runs.toReversed()) {
+        const error = run.error ?? run.secondaryErrors.find((secondary) => secondary.phase !== 'cleanup');
+        if (error !== undefined)
+            return { error, failure: run.failure, artifacts: run.artifacts };
+    }
+    return undefined;
+}
+/** Whether any skipped result followed a failure: what `failOnSkippedFailure` fails a run for. */
+export function someSkippedAfterFailure(results, serialGroups) {
+    const groups = new Map(serialGroups.map((group) => [group.id, group]));
+    return results.some((result) => failureBeforeSkip(result, (id) => groups.get(id)) !== undefined);
+}
 /** Strips the live target from a result for transport. */
 export function encodeResult(record) {
     const { target: _target, ...rest } = record;
     return rest;
 }
-//# sourceMappingURL=records.js.map

package/dist/run/retry.d.ts

@@ -12,7 +12,8 @@ export declare function isRetryEligible(attempt: RetryAttempt): boolean;
  * Runs up to `maxAttempts` attempts, stopping on pass, interrupt, or a
  * failure that does not consume retry budget. `runOnce` returns the
  * finished attempt, or undefined when the attempt could not start (the
- * loop stops and the last observed status stands).
+ * loop stops and the last observed status stands). An interrupt during a
+ * retry keeps the verdict the failed attempt before it reached: the test
+ * did fail, and only its second chance was cut short.
  */
 export declare function runWithRetries(maxAttempts: number, interruptSignal: AbortSignal, runOnce: (attemptIndex: number) => Promise<RetryAttempt | undefined>): Promise<ResultStatus>;
-//# sourceMappingURL=retry.d.ts.map

package/dist/run/retry.js

@@ -8,7 +8,9 @@ export function isRetryEligible(attempt) {
  * Runs up to `maxAttempts` attempts, stopping on pass, interrupt, or a
  * failure that does not consume retry budget. `runOnce` returns the
  * finished attempt, or undefined when the attempt could not start (the
- * loop stops and the last observed status stands).
+ * loop stops and the last observed status stands). An interrupt during a
+ * retry keeps the verdict the failed attempt before it reached: the test
+ * did fail, and only its second chance was cut short.
  */
 export async function runWithRetries(maxAttempts, interruptSignal, runOnce) {
     let finalStatus = 'failed';
@@ -23,7 +25,7 @@ export async function runWithRetries(maxAttempts, interruptSignal, runOnce) {
         if (attempt.status === 'passed')
             return attemptCount > 1 ? 'flaky' : 'passed';
         if (attempt.status === 'interrupted')
-            return 'interrupted';
+            return attemptCount > 1 ? finalStatus : 'interrupted';
         // A body that skipped itself has decided; a retry would only ask again.
         if (attempt.status === 'skipped')
             return 'skipped';
@@ -33,4 +35,3 @@ export async function runWithRetries(maxAttempts, interruptSignal, runOnce) {
     }
     return finalStatus;
 }
-//# sourceMappingURL=retry.js.map

package/dist/run/runner.d.ts

@@ -5,7 +5,7 @@ import { type Shard, type TagMode } from '../collect/select.ts';
 import type { ExploreProgress } from '../explore/progress.ts';
 import { type Report1Document, type ReportExplore } from '../report/build.ts';
 import { type RunEventSink, type RunExitCode, type RunStatus } from './events.ts';
-import type { ResultRecord } from './records.ts';
+import { type ResultRecord } from './records.ts';
 import type { BuiltinReporter, E2EConfig, RecordingMode } from '../types.ts';
 export interface RunOptions {
     cwd?: string | undefined;
@@ -169,7 +169,8 @@ export interface RunOutcome {
     /** Where the AI trace was written; undefined unless `aiTrace` was requested. */
     aiTracePath: string | undefined;
     results: readonly ResultRecord[];
+    /** The config the run resolved; undefined when it failed to load. */
+    config: ResolvedConfig | undefined;
 }
 /** Executes one complete run and returns the outcome without exiting. */
 export declare function run(options?: RunOptions): Promise<RunOutcome>;
-//# sourceMappingURL=runner.d.ts.map

package/dist/run/runner.js

@@ -18,11 +18,13 @@ import { writeJsonReport } from '../report/write.js';
 import { createRunEventEmitter, toEventResult } from './events.js';
 import { allocateAppPorts } from './app-ports.js';
 import { inProcessSpawner } from './in-process.js';
+import { someSkippedAfterFailure } from './records.js';
 import { runUnits } from './scheduler.js';
 import { buildWorkPlans, plannedSlots } from './units.js';
 import { SessionStore } from './sessions.js';
 import { outputLayout } from './output.js';
-import { lastFailedIds, readLastRun } from './last-run.js';
+import { claimRerunDir, pruneArtifacts } from './artifacts.js';
+import { carryForward, lastFailedIds, readLastRun, reportArtifactPaths } from './last-run.js';
 import { childProcessSpawner } from './worker/handle.js';
 import { setSecretRegistry } from '../secrets.js';
 import { withAbort } from '../internal/time.js';
@@ -187,25 +189,38 @@ export async function run(options = {}) {
      */
     const currentExitCode = () => combineExitCodes([
         ...resultExitCodes(results),
+        ...(loaded.config?.failOnSkippedFailure === true && someSkippedAfterFailure(results, serialGroups) ? [1] : []),
         ...runErrors.map((runError) => exitCodeForCategory(runError.error.category)),
         ...(interruptController.signal.aborted ? [130] : []),
     ].filter((code) => code !== 130 || !(runAborted || stoppedEarly)));
     // Detected once the config names the project root; a report written before
     // that (a config failure) has no checkout to describe.
     let vcs;
-    const buildRunReport = (exitCode) => buildReport({
-        runId,
-        config: loaded.config,
-        vcs,
-        startedAt,
-        status: statusOf(exitCode),
-        exitCode,
-        results,
-        serialGroups,
-        runErrors,
-        targetProvenance,
-        explore: options.tests?.explore?.snapshot(),
-    });
+    // The report `--last-failed` selected from, once collection has read it;
+    // reporters get it beside this run's report to fold the rerun into it, and
+    // this run's report carries what it owed that this run left out.
+    let lastRun;
+    // The ids of every test collection found, a setup no selected test needed
+    // among them, and the files it could not collect: what a rerun can still
+    // carry when the report lists no row.
+    let rerunCollection = { testIds: new Set(), uncollectedFiles: new Set() };
+    const buildRunReport = (exitCode) => {
+        const document = buildReport({
+            runId,
+            config: loaded.config,
+            vcs,
+            startedAt,
+            status: statusOf(exitCode),
+            exitCode,
+            results,
+            serialGroups,
+            runErrors,
+            targetProvenance,
+            explore: options.tests?.explore?.snapshot(),
+        });
+        const carried = lastRun === undefined ? undefined : carryForward(lastRun, document, rerunCollection);
+        return carried === undefined ? document : { ...document, run: { ...document.run, carried } };
+    };
     /**
      * Writes the canonical report and returns its path only once the file
      * exists: a host must never be handed a path to a report that was not
@@ -249,9 +264,6 @@ export async function run(options = {}) {
             return undefined;
         }
     };
-    // The report `--last-failed` selected from, once collection has read it;
-    // reporters get it beside this run's report to fold the rerun into it.
-    let lastRun;
     /**
      * Whether the run got as far as its tests. Only such a run writes into the
      * output directory: one that stopped before leaves the previous run's
@@ -300,7 +312,7 @@ export async function run(options = {}) {
             ...(lastRun === undefined ? {} : { lastRun }),
         }, options.reporterTimeout ?? REPORTER_TIMEOUT_MS, forceController.signal);
         listReporter?.rows(rows);
-        return { exitCode, status, report, reportPath, aiTracePath, results };
+        return { exitCode, status, report, reportPath, aiTracePath, results, config: loaded.config };
     };
     if (loaded.config === undefined) {
         recordFailure(loaded.error, 'config');
@@ -364,6 +376,10 @@ export async function run(options = {}) {
                     : collectInMemory(config.projectRoot, options.tests.file, options.tests.registration, consumesSession(options.tests.registration) ? await collectSetups(config) : undefined);
                 const inputs = await selectionInputs(options, config);
                 lastRun = inputs.lastRun;
+                rerunCollection = {
+                    testIds: new Set(collection.tests.map((test) => test.id)),
+                    uncollectedFiles: new Set(collection.uncollected.map((skipped) => skipped.file)),
+                };
                 const selection = repeatEach(select(collection, config, inputs.filters, options.passWithNoTests !== undefined ? { passWithNoTests: options.passWithNoTests } : {}), options.repeatEach ?? 1);
                 return { collection, selection };
             }));
@@ -450,15 +466,26 @@ export async function run(options = {}) {
         // Tests are about to start, and only now is the previous run's evidence
         // given up: the artifact tree is emptied, so what is there once this run
         // ends is its own and nothing a report no longer names, and this run's
-        // report replaces the last. A run that stopped before here (no test
-        // selected, a collection error, a target that cannot record what it asks,
-        // an app that failed to start, an interrupt) leaves both, and
+        // report replaces the last. A `--last-failed` rerun keeps the evidence
+        // the report it reruns names instead, since that report's results fold
+        // into the rerun's and its carried tests do not run again, and files its
+        // own attempts in a fresh `rerun-<n>` directory beside it, so no attempt
+        // overwrites an earlier one's files. A run that stopped before here (no
+        // test selected, a collection error, a target that cannot record what it
+        // asks, an app that failed to start, an interrupt) leaves both, and
         // `--last-failed` still reads the run that executed. A wipe that fails
         // part way has already given up the old evidence, so this run's report
         // records the failure.
         testsStarted = true;
+        let rerunDir;
         try {
-            await rm(layout.artifacts, { recursive: true, force: true });
+            if (lastRun === undefined) {
+                await rm(layout.artifacts, { recursive: true, force: true });
+            }
+            else {
+                await pruneArtifacts(layout.artifacts, reportArtifactPaths(lastRun));
+                rerunDir = await claimRerunDir(layout.artifacts);
+            }
         }
         catch (cause) {
             recordFailure(cause, 'launch');
@@ -482,6 +509,7 @@ export async function run(options = {}) {
                 inMemory: options.tests,
                 runId,
                 artifactsRoot,
+                rerunDir,
                 sessionStore: store,
                 headed: options.headed ?? false,
                 debug,
@@ -495,6 +523,7 @@ export async function run(options = {}) {
                 ports: config.ports,
                 runId,
                 artifactsRoot,
+                rerunDir,
                 headed: options.headed ?? false,
                 sessionsRoot: layout.sessions,
                 sessionKeyBase64: store.exportKeyForWorker(),
@@ -747,13 +776,21 @@ function resultExitCodes(results) {
 /** Why a reporter's `onRunFinished` was given up on: the message is the stderr line. */
 class ReporterAbandoned extends Error {
 }
+/**
+ * The built-in reporters that write files beside `report.json`. A forced
+ * interrupt never abandons them: they are local writes, and giving one up
+ * would leave the previous run's `summary.md` or `junit.xml` beside this
+ * run's report, where CI reads it as this run's.
+ */
+const FILE_REPORTERS = new Set([STATELESS_REPORTERS.junit, STATELESS_REPORTERS.markdown]);
 /**
  * Awaits every reporter's `onRunFinished` at once, each within `timeoutMs`
- * and until a forced interrupt, and collects the summary rows they resolve
- * with. Each reporter gets a signal that aborts on either, so a well-behaved
- * one cancels its own work and leaves no handle holding the process. A
- * reporter that throws, runs out of time, or returns something other than
- * rows is one line on stderr; it can never change the run's outcome.
+ * and, except the built-in file reporters, until a forced interrupt, and
+ * collects the summary rows they resolve with. Each reporter gets a signal
+ * that aborts on either, so a well-behaved one cancels its own work and
+ * leaves no handle holding the process. A reporter that throws, runs out of
+ * time, or returns something other than rows is one line on stderr; it can
+ * never change the run's outcome.
  */
 async function runReporters(reporters, finished, timeoutMs, force) {
     const warn = (reporter, detail) => {
@@ -767,10 +804,12 @@ async function runReporters(reporters, finished, timeoutMs, force) {
         const abandon = new AbortController();
         const timer = setTimeout(() => abandon.abort(new ReporterAbandoned(`did not finish within ${budget}`)), timeoutMs);
         const onForce = () => abandon.abort(new ReporterAbandoned('abandoned: the run was forced to stop'));
-        if (force.aborted)
-            onForce();
-        else
-            force.addEventListener('abort', onForce, { once: true });
+        if (!FILE_REPORTERS.has(reporter)) {
+            if (force.aborted)
+                onForce();
+            else
+                force.addEventListener('abort', onForce, { once: true });
+        }
         try {
             const result = await withAbort(() => Promise.resolve(onRunFinished.call(reporter, finished, abandon.signal)), abandon.signal, () => abandon.signal.reason);
             if (result === undefined)
@@ -803,4 +842,3 @@ function isSummaryRow(value) {
     const { label, text } = value;
     return typeof label === 'string' && label.length > 0 && typeof text === 'string' && text.length > 0;
 }
-//# sourceMappingURL=runner.js.map

package/dist/run/scheduler.d.ts

@@ -66,4 +66,3 @@ export interface RunUnitsOptions {
 }
 /** Runs every planned unit and streams records. */
 export declare function runUnits(options: RunUnitsOptions): Promise<void>;
-//# sourceMappingURL=scheduler.d.ts.map

package/dist/run/scheduler.js

@@ -682,4 +682,3 @@ class Scheduler {
         await Promise.all(remaining.map((worker) => worker.runner.exit));
     }
 }
-//# sourceMappingURL=scheduler.js.map

package/dist/run/secrecy.d.ts

@@ -47,6 +47,15 @@ export declare class SecretExposure {
  * learns them; provider-backed values join as they resolve.
  */
 export declare const processSecrets: SecretLedger;
+/**
+ * A ledger of the static values of `secrets` alone, built once per map. What
+ * text produced before any session exists is redacted with, such as a test
+ * title at collection: every process resolving the same config redacts it
+ * alike, so a test's id agrees between the runner and its workers. A
+ * provider-backed value is not known yet and is not in it. Shared, so it is
+ * handed out read-only: nothing registers into it.
+ */
+export declare function staticSecretLedger(secrets: ResolvedConfig['allSecrets']): Pick<SecretLedger, 'redact' | 'entries'>;
 /** Seeds `processSecrets` with the static values of `secrets`, so output before any session opens is covered too. */
 export declare function registerStaticSecrets(secrets: ResolvedConfig['allSecrets']): void;
 /**
@@ -70,6 +79,12 @@ export declare function registerDerivedSecrets(name: string, derived: readonly s
  * values join through the resolver at fill time.
  */
 export declare function sessionSecrecy(session: TargetSession, secrets: ResolvedConfig['allSecrets']): SessionSecrecy;
+/**
+ * Redacts `text` with every value `session` has seen, or with the static
+ * values while no session is open yet, so text an attempt produces before
+ * its session exists (a step label, a fixture error) is covered too.
+ */
+export declare function redactForSession(session: TargetSession | undefined, secrets: ResolvedConfig['allSecrets'], text: string): string;
 /** What a saved session carries of the secrecy of the attempt that saved it. */
 export interface SavedSecrecy {
     /** Name and value pairs the saving session learned beyond the static config values; travels only inside the encrypted payload. */
@@ -86,4 +101,3 @@ export interface SavedSecrecy {
 export declare function carriedSecrecy(secrecy: SessionSecrecy, secrets: ResolvedConfig['allSecrets']): SavedSecrecy;
 /** Seeds a restored session's secrecy with what the saving session knew, so a value the restored state echoes back is still redacted and withheld. */
 export declare function adoptSecrecy(secrecy: SessionSecrecy, saved: SavedSecrecy): void;
-//# sourceMappingURL=secrecy.d.ts.map

package/dist/run/secrecy.js

@@ -43,6 +43,24 @@ export class SecretExposure {
  * learns them; provider-backed values join as they resolve.
  */
 export const processSecrets = new SecretLedger();
+/** The static ledger of each secrets map, built once. */
+const staticLedgers = new WeakMap();
+/**
+ * A ledger of the static values of `secrets` alone, built once per map. What
+ * text produced before any session exists is redacted with, such as a test
+ * title at collection: every process resolving the same config redacts it
+ * alike, so a test's id agrees between the runner and its workers. A
+ * provider-backed value is not known yet and is not in it. Shared, so it is
+ * handed out read-only: nothing registers into it.
+ */
+export function staticSecretLedger(secrets) {
+    let ledger = staticLedgers.get(secrets);
+    if (ledger === undefined) {
+        ledger = new SecretLedger([...secrets].flatMap(([name, { value }]) => (typeof value === 'string' ? [[name, value]] : [])));
+        staticLedgers.set(secrets, ledger);
+    }
+    return ledger;
+}
 /** Seeds `processSecrets` with the static values of `secrets`, so output before any session opens is covered too. */
 export function registerStaticSecrets(secrets) {
     for (const [name, { value }] of secrets) {
@@ -97,13 +115,21 @@ export function sessionSecrecy(session, secrets) {
     if (secrecy === undefined) {
         registerStaticSecrets(secrets);
         secrecy = {
-            ledger: new SecretLedger([...secrets].flatMap(([name, { value }]) => typeof value === 'string' ? [[name, value]] : [])),
+            ledger: new SecretLedger(staticSecretLedger(secrets).entries()),
             exposure: new SecretExposure(),
         };
         secrecyBySession.set(session, secrecy);
     }
     return secrecy;
 }
+/**
+ * Redacts `text` with every value `session` has seen, or with the static
+ * values while no session is open yet, so text an attempt produces before
+ * its session exists (a step label, a fixture error) is covered too.
+ */
+export function redactForSession(session, secrets, text) {
+    return (session === undefined ? staticSecretLedger(secrets) : sessionSecrecy(session, secrets).ledger).redact(text);
+}
 /**
  * The secrecy a session envelope carries: the provider-resolved values the
  * session learned, which the consumer's session cannot learn again on its
@@ -127,4 +153,3 @@ export function adoptSecrecy(secrecy, saved) {
     if (saved.tainted)
         secrecy.exposure.raise('filled');
 }
-//# sourceMappingURL=secrecy.js.map

package/dist/run/serial.d.ts

@@ -37,6 +37,8 @@ export interface SharedSerialSession {
 export interface SerialHost {
     readonly target: ResolvedTarget;
     readonly artifactsRoot: string;
+    /** See `TargetExecutorOptions.rerunDir`. */
+    readonly rerunDir: string | undefined;
     readonly runId: string;
     /** The configured artifact store, so group-owned artifacts (the shared trace) upload like any other. */
     readonly artifactStore: ArtifactStore | undefined;
@@ -57,4 +59,3 @@ export interface SerialHost {
 }
 /** Runs one serial unit to completion and emits every member result. */
 export declare function runSerialUnit(host: SerialHost, members: readonly TestTargetPair[], file: FileRef): Promise<SerialGroupRecord>;
-//# sourceMappingURL=serial.d.ts.map

package/dist/run/serial.js

@@ -3,7 +3,7 @@ import { classifyError, ConfigurationError, serializeError, } from '../internal/
 import { canonicalDigest, timestamp, uuidv7 } from '../internal/ids.js';
 import { groupTitles } from '../collect/registry.js';
 import { pairRecordings } from '../collect/select.js';
-import { createAttemptArtifacts, sanitizePathSegment } from './artifacts.js';
+import { attemptSegments, createAttemptArtifacts, sanitizePathSegment } from './artifacts.js';
 import { findRegistered, RealmManager } from './realm.js';
 import { isFailedStatus } from './records.js';
 import { runWithRetries } from './retry.js';
@@ -35,8 +35,11 @@ export async function runSerialUnit(host, members, file) {
     const finalStatus = await runWithRetries(first.options.retries + 1, host.interruptSignal, async (attemptIndex) => {
         const attempt = await runSerialAttempt(host, members, file, attemptIndex);
         group.attempts.push(attempt);
-        for (const member of attempt.members)
-            memberFinalStatus.set(member.testId, member);
+        // A retry the run interrupted keeps the verdict before it, so each member keeps what that attempt said.
+        const cutRetry = attemptIndex > 0 && attempt.status === 'interrupted';
+        if (!cutRetry)
+            for (const member of attempt.members)
+                memberFinalStatus.set(member.testId, member);
         // A beforeAll failure is not retry-eligible: the
         // attempt stands as recorded and the retry loop stops here.
         if (attempt.error?.code === 'HOOK_FAILED')
@@ -88,13 +91,13 @@ async function runSerialAttempt(host, members, file, attemptIndex) {
     const memberRecords = [];
     const first = members[0];
     const recordings = pairRecordings(first, attemptIndex);
-    const artifactSegments = [
+    const artifactSegments = attemptSegments(host.rerunDir, [
         host.target.name,
         sanitizePathSegment(first.test.serialId ?? first.test.id),
         first.agent,
         ...repeatSegment(first.repeat),
         `attempt-${attemptIndex}`,
-    ];
+    ]);
     const artifacts = createAttemptArtifacts({
         artifactsRoot: host.artifactsRoot,
         segments: artifactSegments,
@@ -275,4 +278,3 @@ function serialTitlePath(test) {
     const titles = groupTitles(test.serialRoot);
     return titles.length === 0 ? [test.title] : titles;
 }
-//# sourceMappingURL=serial.js.map

package/dist/run/sessions.d.ts

@@ -74,4 +74,3 @@ export declare class SessionStore {
     /** Deletes the run's session directory. */
     cleanup(): void;
 }
-//# sourceMappingURL=sessions.d.ts.map

package/dist/run/sessions.js

@@ -289,4 +289,3 @@ function parsePayload(text, name) {
     }
     return parsed;
 }
-//# sourceMappingURL=sessions.js.map

package/dist/run/standalone.d.ts

@@ -61,4 +61,3 @@ export interface StandaloneAttempt {
  * failure everything that did start is torn down before the error surfaces.
  */
 export declare function openStandaloneAttempt(options: StandaloneAttemptOptions): Promise<StandaloneAttempt>;
-//# sourceMappingURL=standalone.d.ts.map

package/dist/run/standalone.js

@@ -18,7 +18,7 @@ import { TargetExecutor } from './execute.js';
 import { createFixtures } from './fixtures.js';
 import { PreparedEngines, recordingNotices, startDeclaredProcesses, validateEngine } from './provision.js';
 import { attemptRecording } from '../internal/recording-modes.js';
-import { sessionSecrecy } from './secrecy.js';
+import { redactForSession, sessionSecrecy } from './secrecy.js';
 import { SessionStore } from './sessions.js';
 import { outputLayout } from './output.js';
 import { StepRecorder } from './steps.js';
@@ -84,12 +84,13 @@ export async function openStandaloneAttempt(options) {
             ...(options.onProgress === undefined ? {} : { onProgress: (_testId, progress) => options.onProgress?.(progress) }),
         },
     });
+    let session;
     const steps = new StepRecorder(attemptId, {
         maxEventsPerStep: config.limits.maxEventsPerStep,
         projectRoot: config.projectRoot,
+        redact: (text) => redactForSession(session, config.allSecrets, text),
         ...(options.onProgress === undefined ? {} : { onProgress: options.onProgress }),
     });
-    let session;
     const artifacts = createAttemptArtifacts({
         artifactsRoot: layout.artifacts,
         segments: [target.name, 'sessions', attemptId],
@@ -190,4 +191,3 @@ function sessionRecording(recording) {
     const planned = attemptRecording(recording, 0);
     return planned?.keep === 'on-failure' ? undefined : planned;
 }
-//# sourceMappingURL=standalone.js.map

package/dist/run/steps.d.ts

@@ -268,15 +268,9 @@ export interface StepRecorderOptions {
     readonly onProgress?: (progress: StepProgress) => void;
     /** The project root; with it, every step and step error names the test line it came from. */
     readonly projectRoot?: string;
-    /** Replaces secret values in a step error's message and details before the record keeps them. */
+    /** Replaces secret values in a step's label, and in its error's message and details, before the record keeps them. */
     readonly redact?: (text: string) => string;
 }
-/**
- * Whether an unhandled rejection is an abandoned step's: already recorded as
- * `STEP_NOT_AWAITED`, reaching the process only because the promise the
- * test did not await rejected with it. Such a rejection is not a fault.
- */
-export declare function isAbandonedStepRejection(cause: unknown): boolean;
 export declare class StepRecorder {
     private readonly attemptId;
     private readonly attempt;
@@ -306,7 +300,7 @@ export declare class StepRecorder {
     /** Highest timeline index among passed verification steps, or -1 when none has. */
     get lastVerifiedStepIndex(): number;
     /** Runs one public API call as a recorded top-level step. */
-    run<T>(kind: StepKind, api: string, label: string, body: () => Promise<T>, options?: StepRunOptions): Promise<T>;
+    run<T>(kind: StepKind, api: string, rawLabel: string, body: () => Promise<T>, options?: StepRunOptions): Promise<T>;
     private execute;
     /**
      * Fails every step still running once the test body has settled, and
@@ -357,4 +351,3 @@ export declare class StepRecorder {
     private publish;
 }
 export {};
-//# sourceMappingURL=steps.d.ts.map