e2e 0.15.2 → 0.17.0

package/dist/cli/index.d.ts

@@ -1,4 +1,3 @@
 /** e2e CLI. */
 /** CLI entry invoked by the bin wrapper. */
 export declare function main(argv: readonly string[]): Promise<void>;
-//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.js

@@ -266,7 +266,7 @@ async function runToOutcome(telemetry, command, start) {
         const outcome = await start(signals);
         process.exitCode = outcome.exitCode;
         // The run event is the report's own numbers; every run has a report, even one that failed before its first test.
-        telemetry.record(runCompletedEvent(outcome.report, usedFlags(command)));
+        telemetry.record(runCompletedEvent(outcome.report, { command: commandPath(command), flags: usedFlags(command), config: outcome.config }));
     }
     catch (cause) {
         reportFailure(telemetry, cause);
@@ -357,22 +357,22 @@ function createProgram(version, telemetry) {
     });
     program
         .command('login')
-        .summary('sign in to a ChatGPT, GitHub Copilot, or SuperGrok subscription for agent steps')
-        .description('Sign in once to a personal subscription and store the login for the e2e/oauth models: openai (ChatGPT Plus/Pro, the Codex sign-in), github-copilot (GitHub Copilot; reuses the GitHub CLI login or runs a device flow for your OAuth App), spacexai (SuperGrok or X Premium+, device code). The config then constructs the model with chatgpt(), copilot(), or grok() from e2e/oauth/<provider>.')
-        .addArgument(new Argument('[provider]', 'openai, github-copilot, or spacexai; omitted, a picker').choices(PROVIDER_IDS))
+        .summary('sign in to a ChatGPT, GitHub Copilot, OpenCode Console, or SuperGrok subscription for agent steps')
+        .description('Sign in once to a personal subscription and store the login for the e2e/oauth models: openai (ChatGPT Plus/Pro, the Codex sign-in), github-copilot (GitHub Copilot; reuses the GitHub CLI login or runs a device flow for your OAuth App), opencode-console (OpenCode Console, device code), spacexai (SuperGrok or X Premium+, device code). The config then constructs the model with chatgpt(), copilot(), opencodeConsole(), or grok() from e2e/oauth/<provider>.')
+        .addArgument(new Argument('[provider]', 'openai, github-copilot, opencode-console, or spacexai; omitted, a picker').choices(PROVIDER_IDS))
         .option('--device', 'ChatGPT: show a code to enter on another device instead of opening a browser')
         .option('--client-id <id>', 'GitHub Copilot: the client id of your GitHub OAuth App with the device flow enabled')
         .option('--from-gh', 'GitHub Copilot: reuse the token of the signed-in GitHub CLI')
         .option('--enterprise-url <host>', 'GitHub Copilot: the GitHub Enterprise host')
-        .addHelpText('after', ['', examples(['e2e login openai', 'e2e login github-copilot --from-gh', 'e2e login spacexai', 'e2e login']), '', docsLine('/subscriptions')].join('\n'))
+        .addHelpText('after', ['', examples(['e2e login openai', 'e2e login github-copilot --from-gh', 'e2e login opencode-console', 'e2e login spacexai', 'e2e login']), '', docsLine('/subscriptions')].join('\n'))
         .action(async (provider, options) => {
         process.exitCode = await runLogin(provider, options);
     });
     program
         .command('logout')
         .summary('forget a stored subscription login')
-        .description('Remove the stored login of one provider (openai, github-copilot, spacexai). Without a provider, a picker over the stored logins.')
-        .addArgument(new Argument('[provider]', 'openai, github-copilot, or spacexai; omitted, a picker').choices(PROVIDER_IDS))
+        .description('Remove the stored login of one provider (openai, github-copilot, opencode-console, spacexai). Without a provider, a picker over the stored logins.')
+        .addArgument(new Argument('[provider]', 'openai, github-copilot, opencode-console, or spacexai; omitted, a picker').choices(PROVIDER_IDS))
         .addHelpText('after', ['', examples(['e2e logout', 'e2e logout openai']), '', docsLine('/subscriptions')].join('\n'))
         .action(async (provider) => {
         process.exitCode = await runLogout(provider);
@@ -380,8 +380,8 @@ function createProgram(version, telemetry) {
     program
         .command('models')
         .summary('list the models a stored subscription login serves')
-        .description('Ask the vendor which models the stored login serves and print their ids, the ones chatgpt(), copilot(), and grok() take. Without a provider, every stored login in turn.')
-        .addArgument(new Argument('[provider]', 'openai, github-copilot, or spacexai; omitted, every stored login').choices(PROVIDER_IDS))
+        .description('Ask the vendor which models the stored login serves and print their ids, the ones chatgpt(), copilot(), opencodeConsole(), and grok() take. Without a provider, every stored login in turn.')
+        .addArgument(new Argument('[provider]', 'openai, github-copilot, opencode-console, or spacexai; omitted, every stored login').choices(PROVIDER_IDS))
         .addHelpText('after', ['', examples(['e2e models', 'e2e models openai']), '', docsLine('/subscriptions#pick-a-model')].join('\n'))
         .action(async (provider) => {
         process.exitCode = await runModels(provider);
@@ -410,7 +410,7 @@ function createProgram(version, telemetry) {
         docsLine('/reference/mcp'),
     ].join('\n'))
         .action(async (options) => {
-        process.exitCode = await mcp(version, options);
+        process.exitCode = await mcp(version, options, telemetry);
     });
     const runCommand = program
         .command('run')
@@ -694,4 +694,3 @@ export async function main(argv) {
         await telemetry.flush();
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/cli/init/agent-skill.d.ts

@@ -111,4 +111,3 @@ export declare function describeLinks(install: SkillInstall): string;
 /** The install's obstacles for a message: the directory, then each entry and what it is in parentheses. */
 export declare function describeObstacles(install: SkillInstall): string;
 export {};
-//# sourceMappingURL=agent-skill.d.ts.map

package/dist/cli/init/agent-skill.js

@@ -212,4 +212,3 @@ function linkTarget(link) {
 function posixRelative(from, absolute) {
     return path.relative(from, absolute).split(path.sep).join('/');
 }
-//# sourceMappingURL=agent-skill.js.map

package/dist/cli/init/engines.d.ts

@@ -16,9 +16,7 @@ export declare function getEnginePresets(): readonly [{
     readonly id: 'web';
     readonly label: 'Web';
     readonly hint: 'Playwright';
-    readonly dependencies: {
-        readonly playwright: string;
-    };
+    readonly dependencies: Readonly<Record<string, string>>;
     readonly imports: readonly ["import { web } from '@e2e-dev/web';"];
     readonly config: `  targets: [{
     engine: web(),
@@ -76,4 +74,3 @@ export type EngineId = ReturnType<typeof getEnginePresets>[number]['id'];
 export declare const DEFAULT_ENGINE_ID = "web";
 /** Resolves a preset with the common shape used by scaffold generation. */
 export declare function getEnginePreset(id: EngineId): EnginePreset;
-//# sourceMappingURL=engines.d.ts.map

package/dist/cli/init/engines.js

@@ -1,6 +1,6 @@
 /** CLI scaffold presets. Engine packages are referenced as generated source, never imported. */
 import os from 'node:os';
-import { playwrightRange, siblingDependency, SIBLING_VERSIONS } from './versions.js';
+import { siblingDependency } from './versions.js';
 /** Builds prompt choices and scaffolds with defaults for the machine running init. */
 export function getEnginePresets() {
     const ios = os.platform() === 'darwin';
@@ -9,7 +9,7 @@ export function getEnginePresets() {
             id: 'web',
             label: 'Web',
             hint: 'Playwright',
-            dependencies: { ...siblingDependency('@e2e-dev/web'), playwright: playwrightRange(SIBLING_VERSIONS?.['playwright']) },
+            dependencies: siblingDependency('@e2e-dev/web'),
             imports: ["import { web } from '@e2e-dev/web';"],
             config: `  targets: [{
     engine: web(),
@@ -104,4 +104,3 @@ export function getEnginePreset(id) {
         throw new Error(`unknown engine: ${id}`);
     return preset;
 }
-//# sourceMappingURL=engines.js.map

package/dist/cli/init/gateways.d.ts

@@ -4,7 +4,7 @@
  * of them and takes the constructed instance. Adding a gateway is adding an
  * entry here.
  */
-export type GatewayId = 'vercel' | 'openrouter' | 'openai-compatible' | 'chatgpt' | 'copilot' | 'grok';
+export type GatewayId = 'vercel' | 'openrouter' | 'openai-compatible' | 'chatgpt' | 'copilot' | 'opencode-console' | 'grok';
 export interface GatewayPreset {
     readonly id: GatewayId;
     readonly label: string;
@@ -21,4 +21,3 @@ export interface GatewayPreset {
 }
 export declare const GATEWAYS: readonly GatewayPreset[];
 export declare function getGatewayPreset(id: GatewayId): GatewayPreset;
-//# sourceMappingURL=gateways.d.ts.map

package/dist/cli/init/gateways.js

@@ -50,12 +50,22 @@ export const GATEWAYS = [
         id: 'copilot',
         label: 'GitHub Copilot subscription',
         hint: 'your Copilot plan: OpenAI, Anthropic, Google, and SpaceXAI models',
-        dependencies: { '@ai-sdk/openai-compatible': '^3.0.0' },
+        dependencies: { '@ai-sdk/openai-compatible': '^3.0.0', '@ai-sdk/openai': '^4.0.0' },
         import: "import { copilot } from 'e2e/oauth/copilot';",
         comment: 'Your GitHub Copilot subscription serves the model; sign in once with `e2e login github-copilot`, `e2e models github-copilot` lists the ids.',
         login: 'github-copilot',
         model: () => "copilot('claude-sonnet-5')",
     },
+    {
+        id: 'opencode-console',
+        label: 'OpenCode Console',
+        hint: 'the models your OpenCode Console workspace serves',
+        dependencies: { '@ai-sdk/openai-compatible': '^3.0.0', '@ai-sdk/openai': '^4.0.0', '@ai-sdk/anthropic': '^4.0.0', '@ai-sdk/google': '^4.0.0' },
+        import: "import { opencodeConsole } from 'e2e/oauth/opencode-console';",
+        comment: 'Your OpenCode Console workspace serves the model; sign in once with `e2e login opencode-console`, `e2e models opencode-console` lists the ids.',
+        login: 'opencode-console',
+        model: () => "opencodeConsole('deepseek-v4.1-flash')",
+    },
     {
         id: 'grok',
         label: 'SuperGrok subscription',
@@ -77,4 +87,3 @@ export function getGatewayPreset(id) {
 function quote(value) {
     return `'${value.replaceAll('\\', '\\\\').replaceAll("'", "\\'")}'`;
 }
-//# sourceMappingURL=gateways.js.map

package/dist/cli/init/mcp-config.d.ts

@@ -28,4 +28,3 @@ export declare function findRegisteredMcpFiles(cwd: string): string[];
  * Other servers, other keys, and the file's indentation are preserved.
  */
 export declare function planMcpRegistration(cwd: string, files: readonly string[]): McpRegistration[];
-//# sourceMappingURL=mcp-config.d.ts.map

package/dist/cli/init/mcp-config.js

@@ -69,4 +69,3 @@ export function planMcpRegistration(cwd, files) {
     }
     return registrations;
 }
-//# sourceMappingURL=mcp-config.js.map

package/dist/cli/init/package.d.ts

@@ -60,4 +60,3 @@ export declare function addScripts(manifest: PackageManifest, scripts: Readonly<
  */
 export declare function serializePackage(manifest: PackageManifest, original: string | undefined): string;
 export {};
-//# sourceMappingURL=package.d.ts.map

package/dist/cli/init/package.js

@@ -99,4 +99,3 @@ function ordering(value, reference) {
             out[key] = entry;
     return out;
 }
-//# sourceMappingURL=package.js.map

package/dist/cli/init/scaffold.d.ts

@@ -16,4 +16,3 @@ export declare function createScaffold(engineId: EngineId, model: ScaffoldModel
     example: string;
     needsAppUrl: boolean;
 };
-//# sourceMappingURL=scaffold.d.ts.map

package/dist/cli/init/scaffold.js

@@ -48,4 +48,3 @@ ${configFields.join('\n')}
         needsAppUrl: engine.needsAppUrl,
     };
 }
-//# sourceMappingURL=scaffold.js.map

package/dist/cli/init/sibling-versions.json

@@ -1 +1 @@
-{"@e2e-dev/web":"0.11.1","@e2e-dev/mobile":"0.9.0","playwright":"1.63.0"}
+{"@e2e-dev/web":"0.12.0","@e2e-dev/mobile":"0.9.2"}

package/dist/cli/init/versions.d.ts

@@ -3,7 +3,6 @@
  * build in `sibling-versions.json` next to this module from their manifests.
  * Absent when running from source. Both preset tables read from here.
  */
-export declare const SIBLING_VERSIONS: Readonly<Record<string, string>> | undefined;
 /**
  * The range init writes for the runner and for an engine. Engines version
  * independently of the runner and pin it through their own peer range, so init
@@ -20,11 +19,3 @@ export declare const SIBLING_VERSIONS: Readonly<Record<string, string>> | undefi
 export declare function dependencyRange(version: string | undefined): string;
 /** The range init writes for a sibling `@e2e-dev/*` package released alongside this runner. */
 export declare function siblingDependency(name: string): Readonly<Record<string, string>>;
-/**
- * The range init writes for `playwright`, which `@e2e-dev/web` peers on
- * rather than installs, so an app that already ships Playwright keeps one copy
- * and one browser cache. The build records the version the engine was built
- * and tested against; from source, where nothing is recorded, any 1.x will do.
- */
-export declare function playwrightRange(version: string | undefined): string;
-//# sourceMappingURL=versions.d.ts.map

package/dist/cli/init/versions.js

@@ -4,7 +4,7 @@
  * Absent when running from source. Both preset tables read from here.
  */
 import { readJson } from '../../internal/package-version.js';
-export const SIBLING_VERSIONS = readJson(import.meta.url, './sibling-versions.json');
+const SIBLING_VERSIONS = readJson(import.meta.url, './sibling-versions.json');
 /**
  * The range init writes for the runner and for an engine. Engines version
  * independently of the runner and pin it through their own peer range, so init
@@ -27,13 +27,3 @@ export function dependencyRange(version) {
 export function siblingDependency(name) {
     return { [name]: dependencyRange(SIBLING_VERSIONS?.[name]) };
 }
-/**
- * The range init writes for `playwright`, which `@e2e-dev/web` peers on
- * rather than installs, so an app that already ships Playwright keeps one copy
- * and one browser cache. The build records the version the engine was built
- * and tested against; from source, where nothing is recorded, any 1.x will do.
- */
-export function playwrightRange(version) {
-    return version === undefined ? '^1' : `^${version}`;
-}
-//# sourceMappingURL=versions.js.map

package/dist/cli/init.d.ts

@@ -24,4 +24,3 @@ export interface InitOptions {
 export declare function init(cwd: string, options?: InitOptions): Promise<InitOutcome & {
     readonly exitCode: number;
 }>;
-//# sourceMappingURL=init.d.ts.map

package/dist/cli/init.js

@@ -373,4 +373,3 @@ function cancelled() {
     clack.cancel('Cancelled; no changes were made');
     return 0;
 }
-//# sourceMappingURL=init.js.map

package/dist/cli/mcp.d.ts

@@ -5,12 +5,19 @@
  * transport keeps the process's own stdout writer, and everything else that
  * reaches process.stdout is redirected to stderr for the whole process.
  */
+import { type ServeOptions } from '../mcp/server.ts';
+import type { Telemetry } from '../telemetry/telemetry.ts';
 export interface McpCommandOptions {
     config?: string | undefined;
     target?: string | undefined;
     headless?: boolean | undefined;
     maxSessions?: number | undefined;
 }
+/**
+ * Records each MCP session as it ends and sends it at once: a server lives
+ * as long as its client, and one its client kills never reaches the flush
+ * at exit.
+ */
+export declare function sessionTelemetry(telemetry: Telemetry): NonNullable<ServeOptions['onSessionEnd']>;
 /** Runs the server until the client disconnects or a signal arrives; returns the exit code. */
-export declare function mcp(version: string, options: McpCommandOptions): Promise<number>;
-//# sourceMappingURL=mcp.d.ts.map
+export declare function mcp(version: string, options: McpCommandOptions, telemetry: Telemetry): Promise<number>;

package/dist/cli/mcp.js

@@ -9,6 +9,7 @@ import { Writable } from 'node:stream';
 import { isCiMode } from '../config/resolve.js';
 import { errorMessage, exitCodeForCategory, classifyError } from '../internal/errors.js';
 import { serveMcp } from '../mcp/server.js';
+import { mcpSessionEvent } from '../telemetry/events.js';
 /**
  * Diverts every later `process.stdout` write to stderr and returns a stream
  * that still reaches the real stdout. The protocol stream wraps the original
@@ -37,8 +38,19 @@ function claimStdout() {
     stderr.on('error', () => undefined);
     return protocol;
 }
+/**
+ * Records each MCP session as it ends and sends it at once: a server lives
+ * as long as its client, and one its client kills never reaches the flush
+ * at exit.
+ */
+export function sessionTelemetry(telemetry) {
+    return (summary, client) => {
+        telemetry.record(mcpSessionEvent(summary, client));
+        void telemetry.sendQueued();
+    };
+}
 /** Runs the server until the client disconnects or a signal arrives; returns the exit code. */
-export async function mcp(version, options) {
+export async function mcp(version, options, telemetry) {
     const stdout = claimStdout();
     const stop = new AbortController();
     const onSignal = () => stop.abort();
@@ -57,6 +69,7 @@ export async function mcp(version, options) {
             stdout,
             log: (line) => process.stderr.write(`e2e mcp: ${line}\n`),
             signal: stop.signal,
+            onSessionEnd: sessionTelemetry(telemetry),
         });
     }
     catch (cause) {
@@ -69,4 +82,3 @@ export async function mcp(version, options) {
         process.off('SIGTERM', onSignal);
     }
 }
-//# sourceMappingURL=mcp.js.map

package/dist/cli/signals.d.ts

@@ -23,4 +23,3 @@ export declare class SignalLadder {
     /** Installs the process handlers; returns their removal. */
     arm(exit?: (code: number) => void): () => void;
 }
-//# sourceMappingURL=signals.d.ts.map

package/dist/cli/signals.js

@@ -45,4 +45,3 @@ export class SignalLadder {
         };
     }
 }
-//# sourceMappingURL=signals.js.map

package/dist/cli/skill.d.ts

@@ -13,4 +13,3 @@ export declare function readSkillFiles(): readonly SkillFile[];
 export declare function skillTopics(): readonly string[];
 /** The overview (`SKILL.md` without its frontmatter) or one topic's text; undefined for an unknown topic. */
 export declare function readGuide(topic: string | undefined): string | undefined;
-//# sourceMappingURL=skill.d.ts.map

package/dist/cli/skill.js

@@ -54,4 +54,3 @@ export function readGuide(topic) {
     }
     return files.find((file) => file.relative === `${TOPIC_PREFIX}${topic}.md`)?.content;
 }
-//# sourceMappingURL=skill.js.map

package/dist/cli/telemetry.d.ts

@@ -9,4 +9,3 @@ export declare const TELEMETRY_ACTIONS: readonly TelemetryAction[];
  * choice could not be saved.
  */
 export declare function telemetry(action: TelemetryAction, instance: Telemetry): number;
-//# sourceMappingURL=telemetry.d.ts.map

package/dist/cli/telemetry.js

@@ -29,7 +29,7 @@ export function telemetry(action, instance) {
     const disabledBy = instance.disabledBy;
     if (disabledBy === undefined) {
         out(`Status: ${picocolors.green('enabled')}`);
-        out('Anonymous usage data is sent: the command, the versions, the OS, and run counts. Never test names, app data, or credentials.');
+        out('Anonymous usage data is sent: the command, the versions, the OS, and summaries of runs and MCP sessions. Never test names, app data, or credentials.');
     }
     else {
         out(`Status: ${picocolors.red('disabled')} (${REASONS[disabledBy]})`);
@@ -38,4 +38,3 @@ export function telemetry(action, instance) {
     out(`Details: ${DOCS_URL}/telemetry`);
     return 0;
 }
-//# sourceMappingURL=telemetry.js.map

package/dist/cli/wordmark.d.ts

@@ -36,4 +36,3 @@ export interface PlayWordmarkOptions {
  * as an interrupted run does.
  */
 export declare function playWordmark(stream: WordmarkStream, options?: PlayWordmarkOptions): Promise<void>;
-//# sourceMappingURL=wordmark.d.ts.map

package/dist/cli/wordmark.js

@@ -262,4 +262,3 @@ export async function playWordmark(stream, options = {}) {
         stream.write(SHOW_CURSOR);
     }
 }
-//# sourceMappingURL=wordmark.js.map

package/dist/collect/collect.d.ts

@@ -165,4 +165,3 @@ export declare function collectSetups(config: ResolvedConfig): Promise<Collectio
  * stop `e2e run tests/one.e2e.ts`.
  */
 export declare function collect(config: ResolvedConfig, positionals?: readonly string[]): Promise<Collection>;
-//# sourceMappingURL=collect.d.ts.map

package/dist/collect/collect.js

@@ -6,6 +6,7 @@ import { CollectionError } from '../internal/errors.js';
 import { setupTestId, testId } from '../internal/ids.js';
 import { explainModuleError } from '../config/diagnose.js';
 import { importModule } from '../config/load.js';
+import { staticSecretLedger } from '../run/secrecy.js';
 import { collectModule, groupTitles, outermostSerialGroup, } from './registry.js';
 /** Narrows a collected test to its reportable, serializable identity. */
 export function testIdentity(test) {
@@ -345,12 +346,13 @@ export async function collect(config, positionals = []) {
 async function collectFiles(config, discovered, isSelected, narrowed, lines) {
     const files = [];
     const uncollected = [];
+    const { redact } = staticSecretLedger(config.allSecrets);
     for (const file of discovered) {
         const absolutePath = path.join(config.projectRoot, file);
         const skippable = narrowed && !isSelected(file);
         let registration;
         try {
-            registration = await collectModule(() => importModule(absolutePath, 'collect'), absolutePath);
+            registration = await collectModule(() => importModule(absolutePath, 'collect'), absolutePath, redact);
         }
         catch (cause) {
             if (skippable) {
@@ -373,4 +375,3 @@ async function collectFiles(config, discovered, isSelected, narrowed, lines) {
     }
     return { files, uncollected };
 }
-//# sourceMappingURL=collect.js.map

package/dist/collect/registry.d.ts

@@ -73,9 +73,13 @@ export declare function outermostSerialGroup(group: GroupNode | undefined): Grou
 /**
  * Runs `load` with a fresh collector active and returns everything it
  * registered. `moduleFile` is the absolute path of the module `load` imports;
- * a test's source prefers a frame in that file.
+ * a test's source prefers a frame in that file. `redactTitle` is applied to
+ * every test and describe title as it registers, so a secret a title spells
+ * out never reaches a test id, a report, or a path derived from either; the
+ * runner passes the static secrets of the config (`staticSecretLedger`), the
+ * same in every process, so ids agree across them.
  */
-export declare function collectModule(load: () => Promise<unknown>, moduleFile?: string): Promise<ModuleRegistration>;
+export declare function collectModule(load: () => Promise<unknown>, moduleFile?: string, redactTitle?: (title: string) => string): Promise<ModuleRegistration>;
 export declare const test: TestAPI;
 /**
  * `test.describe` and the hooks as top-level imports. The per-test hooks
@@ -87,4 +91,3 @@ export declare const describe: {
     <Result>(title: string, options: DescribeOptions, body: import("../types.ts").SynchronousBody<Result>): void;
 }, beforeEach: (fn: TestHookFn<import("../types.ts").TestFixtures>) => void, afterEach: (fn: TestHookFn<import("../types.ts").TestFixtures>) => void, beforeAll: (fn: SuiteHookFn) => void, afterAll: (fn: SuiteHookFn) => void;
 export {};
-//# sourceMappingURL=registry.d.ts.map

package/dist/collect/registry.js

@@ -12,6 +12,7 @@ import { parseSkipCall, skipRunningTest } from '../internal/skip.js';
 import { unknownKeyMessage } from '../internal/options.js';
 const SESSION_NAME_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
 class Collector {
+    redactTitle;
     tests = [];
     hooks = [];
     currentGroup = undefined;
@@ -19,13 +20,31 @@ class Collector {
     closed = false;
     /** Real path of the module being collected, the file a test's source prefers. */
     moduleFile;
-    constructor(moduleFile) {
+    constructor(moduleFile, 
+    /** Rewrites a registered secret value in a title to its marker. */
+    redactTitle) {
+        this.redactTitle = redactTitle;
         this.moduleFile = moduleFile === undefined ? undefined : realPath(moduleFile);
     }
     close() {
         this.closed = true;
         return { tests: this.tests, hooks: this.hooks };
     }
+    /**
+     * The title as it registers: validated as written, redacted, then
+     * normalized to NFC, and validated again, since a marker can be longer
+     * than the value it replaces.
+     */
+    title(raw) {
+        const rawError = validateTitle(raw);
+        if (rawError !== null)
+            throw new CollectionError(rawError);
+        const title = this.redactTitle(raw).normalize('NFC');
+        const error = title === raw.normalize('NFC') ? null : validateTitle(title);
+        if (error !== null)
+            throw new CollectionError(`${error} once secret values are redacted`);
+        return title;
+    }
     assertOpen(api) {
         if (this.closed) {
             throw new CollectionError(`${api} was called after module evaluation finished; registration must be synchronous`);
@@ -33,10 +52,7 @@ class Collector {
     }
     registerTest(kind, mode, title, options, sessions, fn, fixtures) {
         this.assertOpen(kind === 'setup' ? 'test.setup()' : 'test()');
-        const titleError = validateTitle(title);
-        if (titleError !== null)
-            throw new CollectionError(titleError);
-        const normalizedTitle = title.normalize('NFC');
+        const normalizedTitle = this.title(title);
         if (typeof fn !== 'function')
             throw new CollectionError('test body must be a function');
         if (kind === 'setup') {
@@ -80,14 +96,12 @@ class Collector {
     }
     registerDescribe(title, options, body) {
         this.assertOpen('describe()');
-        const titleError = validateTitle(title);
-        if (titleError !== null)
-            throw new CollectionError(titleError);
+        const normalizedTitle = this.title(title);
         if (typeof body !== 'function')
             throw new CollectionError('describe body must be a function');
         validateDescribeOptions(options, this.currentGroup);
         const group = {
-            title: title.normalize('NFC'),
+            title: normalizedTitle,
             options,
             parent: this.currentGroup,
             serial: options.serial === true,
@@ -97,7 +111,7 @@ class Collector {
         try {
             const result = body();
             if (isPromiseLike(result)) {
-                throw new CollectionError(`describe body for ${JSON.stringify(title)} must finish synchronously`);
+                throw new CollectionError(`describe body for ${JSON.stringify(group.title)} must finish synchronously`);
             }
         }
         finally {
@@ -311,13 +325,17 @@ const collectorSlot = realmSlot('e2e.activeCollector.v1');
 /**
  * Runs `load` with a fresh collector active and returns everything it
  * registered. `moduleFile` is the absolute path of the module `load` imports;
- * a test's source prefers a frame in that file.
+ * a test's source prefers a frame in that file. `redactTitle` is applied to
+ * every test and describe title as it registers, so a secret a title spells
+ * out never reaches a test id, a report, or a path derived from either; the
+ * runner passes the static secrets of the config (`staticSecretLedger`), the
+ * same in every process, so ids agree across them.
  */
-export async function collectModule(load, moduleFile) {
+export async function collectModule(load, moduleFile, redactTitle = (title) => title) {
     if (collectorSlot.get(globalThis) !== undefined) {
         throw new CollectionError('collection is already in progress');
     }
-    const collector = new Collector(moduleFile);
+    const collector = new Collector(moduleFile, redactTitle);
     collectorSlot.set(globalThis, collector);
     try {
         await load();
@@ -495,4 +513,3 @@ export const test = createTestAPI([]);
  * registers through that `test`, or an engine's re-export of these.
  */
 export const { describe, beforeEach, afterEach, beforeAll, afterAll } = test;
-//# sourceMappingURL=registry.js.map

package/dist/collect/select.d.ts

@@ -114,4 +114,3 @@ export declare function select(collection: Collection, config: ResolvedConfig, f
  * count, and a filtered or skipped pair is reported once.
  */
 export declare function repeatEach(selection: Selection, times: number): Selection;
-//# sourceMappingURL=select.d.ts.map

package/dist/collect/select.js

@@ -661,4 +661,3 @@ function appKinds(target) {
     const { base, bundleId, appPath } = target.app;
     return [...(base === undefined ? [] : ['browser']), ...(bundleId === undefined && appPath === undefined ? [] : ['native-app'])];
 }
-//# sourceMappingURL=select.js.map

package/dist/config/agent.d.ts

@@ -101,4 +101,3 @@ export declare function isVisionMode(value: unknown): value is VisionMode;
  * from any realm or provider package are accepted.
  */
 export declare function isModelInstance(value: unknown): value is ModelInstance;
-//# sourceMappingURL=agent.d.ts.map

package/dist/config/agent.js

@@ -304,4 +304,3 @@ function validateContext(context, label) {
     }
     return context;
 }
-//# sourceMappingURL=agent.js.map

package/dist/config/app.d.ts

@@ -120,4 +120,3 @@ export declare function digestTargetApp(app: TargetAppDeclaration): import("../i
         reuseExisting?: boolean;
     }> | undefined;
 }>;
-//# sourceMappingURL=app.d.ts.map

package/dist/config/app.js

@@ -169,4 +169,3 @@ export function digestTargetApp(app) {
     const { command, ...facts } = app;
     return obj({ ...facts, command: command === undefined ? undefined : digestCommand(command) });
 }
-//# sourceMappingURL=app.js.map

package/dist/config/command.d.ts

@@ -43,4 +43,3 @@ export declare function digestCommand(command: CommandConfig): import("../intern
     log?: string;
     reuseExisting?: boolean;
 }>;
-//# sourceMappingURL=command.d.ts.map

package/dist/config/command.js

@@ -100,4 +100,3 @@ export function digestCommand(command) {
     const { env, ...rest } = command;
     return obj({ ...rest, env: env === undefined ? undefined : Object.fromEntries(Object.keys(env).map((key) => [key, { envName: key }])) });
 }
-//# sourceMappingURL=command.js.map

package/dist/config/diagnose.d.ts

@@ -12,4 +12,3 @@ export declare const RUNTIME_EXPORTS: readonly string[];
  * its own message.
  */
 export declare function explainModuleError(cause: unknown, importer: string): string;
-//# sourceMappingURL=diagnose.d.ts.map

package/dist/config/diagnose.js

@@ -159,4 +159,3 @@ function nearestManifest(dir) {
         current = parent;
     }
 }
-//# sourceMappingURL=diagnose.js.map

package/dist/config/esm-hooks.d.ts

@@ -54,4 +54,3 @@ export declare const resolveSync: ResolveHookSync;
 /** For `module.register`, which reads this export from the hook module. */
 export declare const resolve: ResolveHook;
 export {};
-//# sourceMappingURL=esm-hooks.d.ts.map

package/dist/config/esm-hooks.js

@@ -99,4 +99,3 @@ export function inGraph(specifier, context, resolution) {
 export const resolveSync = (specifier, context, nextResolve) => inGraph(specifier, context, asModule(specifier, context, nextResolve(specifier, context)));
 /** For `module.register`, which reads this export from the hook module. */
 export const resolve = async (specifier, context, nextResolve) => inGraph(specifier, context, asModule(specifier, context, await nextResolve(specifier, context)));
-//# sourceMappingURL=esm-hooks.js.map

package/dist/config/load.d.ts

@@ -48,4 +48,3 @@ export interface ConfigLoadOptions {
 export declare function importModule(absolutePath: string, cacheKey?: string): Promise<unknown>;
 /** Loads and returns the raw default export of a config module. */
 export declare function loadConfigModule(configPath: string, options?: ConfigLoadOptions): Promise<E2EConfig>;
-//# sourceMappingURL=load.d.ts.map