e2e 0.17.0 → 0.18.0

package/docs/reference/config.mdx

@@ -1,6 +1,7 @@
 ---
 title: E2EConfig
 description: Every configuration key, its default, its valid range, and the environment variables.
+icon: "sliders"
 ---
 
 Export an object from `e2e.config.ts` and use `satisfies E2EConfig` to check
@@ -69,10 +70,45 @@ It throws when the file is missing; guard it with `existsSync` from
 `node:fs` when only some machines have one.
 
 Config and test files run as ESM whatever the nearest `package.json` `type`
-says, and so does the TypeScript they import: a helper by path, or a
-workspace package that exports its `.ts` source by name. An installed package
-imported by name keeps its own format. A config or test written with `require`
-or `module.exports` fails to load.
+says, and so does every `.ts`, `.mts`, `.tsx`, and `.jsx` file they reach: a
+helper by path, a package that exports its `.ts` source by name, or a `.ts`
+file a CommonJS file requires. A `.cts` file is CommonJS, written with
+`require`, `import x = require()`, and `export =`; its `import` statements are
+not turned into `require` calls. A `.ts` file written with `require` or
+`module.exports` fails to load: name it `.cts`. JavaScript keeps the format
+its package declares.
+
+e2e compiles TypeScript and JSX itself, and an import written in such a file
+resolves the way TypeScript resolves it: `./helper.js` and `./helper` load
+`helper.ts`, `./view.jsx` loads `view.tsx`, `./lib` loads the file
+`lib/package.json` names as `main`, else `lib/index.ts`, a bare import that
+`tsconfig.json` maps through `paths` or `baseUrl` loads the mapped file, and
+a `#` import or package export that names a missing `./x.js`, `./x.jsx`, or
+`./x` loads its `x.ts` or `x.tsx` source when imported (a `require()` of it fails as Node.js reports
+it). An import written in a JavaScript file resolves
+as Node.js resolves it.
+
+The `tsconfig.json` is the nearest one above the file, or, when that one has
+`references` and does not include the file itself (as Vite writes it), the
+directly referenced one that does. e2e reads its `paths`, `baseUrl`, `jsx`, `jsxFactory`,
+`jsxFragmentFactory`, `jsxImportSource`, `experimentalDecorators`,
+`emitDecoratorMetadata`, `useDefineForClassFields` (and `target`, which sets
+its default), and `verbatimModuleSyntax`, once per process and again for each
+session `e2e mcp` opens. A `tsconfig.json` e2e cannot read, such as one that
+`extends` a package that is not installed, is skipped with a warning.
+TypeScript inside an installed package compiles without the project's
+`tsconfig.json`.
+
+e2e refuses, naming the file and line, two things it cannot compile:
+auto-accessors (`accessor x = 1`) and decorators without
+`experimentalDecorators`. Each file compiles on its own, without type
+information, so a type imported without `import type` fails to load when the
+import stays in the output (a decorated member's type under
+`emitDecoratorMetadata`, a re-exported type); the error names the import to
+change. A JSON file imported without `with { type: 'json' }` loads with its
+parsed contents as the default export. Stack traces and failure locations
+point at the TypeScript source, through another loader's source map too
+(`NODE_OPTIONS=--import tsx`).
 
 ## Top level
 
@@ -895,7 +931,7 @@ See [Secrets that are not passwords](/authentication#secrets-that-are-not-passwo
 In `read-write` mode the replay cache records an `agent.act()` only after a
 later verification passes, such as a locator assertion or `agent.assert()`.
 `read-only` replays existing entries and writes none; `off` disables both.
-See [Caching agent steps](/cache).
+See [Caching](/cache).
 
 ```ts
 /**
@@ -950,7 +986,7 @@ instead of a hand-off to the agent; see
 `e2e init` adds `.e2e/cache/` to `.gitignore`, so committing entries is
 opt-in. Remove that line to share replays with CI and teammates; CI stays
 `read-only` unless `cache: 'read-write'` is set. See
-[Caching agent steps](/cache#commit-the-replay-cache).
+[Caching](/cache#commit-the-replay-cache).
 
 ## Run limits
 

package/docs/reference/engine.mdx

@@ -1,6 +1,7 @@
 ---
 title: e2e/engine
 description: Build an engine with observations, actions, lifecycle hooks, and fixtures.
+icon: "gear"
 ---
 
 Import engine types and helpers from `e2e/engine`. `defineEngine` validates
@@ -709,7 +710,11 @@ export type PointerAction =
       readonly direction: ScrollDirection;
       readonly momentum?: Momentum;
     }
-  | { readonly kind: 'swipeTo'; readonly target: ViewportPoint };
+  | {
+      readonly kind: 'swipeTo';
+      readonly target: ViewportPoint;
+      readonly durationMs?: number;
+    };
 
 /** Every pointer action kind; what an engine declares in `pointerActions`. */
 export type PointerActionKind = PointerAction['kind'];
@@ -923,6 +928,13 @@ export const RETRYABLE_ENGINE_ERROR_CODES: ReadonlySet<EngineErrorCode> = new Se
 | `INVALID_STATE` | `APP_NOT_OPEN` | no |
 | `ENGINE_FAILURE`, any non-`EngineError` | infrastructure `ENGINE_FAILURE` | no |
 
+An `OPERATION_TIMEOUT` on a locate or read that started with under 100 ms of
+a waiting call's deadline left, after one that completed, ends the wait
+instead: an action's or `waitFor`'s `LOCATOR_NOT_FOUND`, or an assertion's
+`ASSERTION_FAILED`, with the timeout as its cause. A negated assertion passes
+there if its negation had held long enough by the time the read was cut off, as
+`pollCondition` below describes.
+
 An `EngineError` a contributed fixture method throws is mapped by the table
 above, so a fixture over a session that ended reports `APP_NOT_OPEN` the way
 an observation would. A method can also fail a step with the runner's own
@@ -961,7 +973,7 @@ Use these helpers to keep behavior consistent across engines:
 | `matchesText(actual, pattern)`, `toTextPattern(match, { exact? })`, `describePattern(pattern)` | `TextPattern` matching for `locate` and text matchers; `toTextPattern` throws `INVALID_ARGUMENT` for a `match` that is neither a string nor a `RegExp` |
 | `resolveExpression(expression, nodes, { selector? })` | The reference `locate`. Resolves one `LocatorExpression` over a semantic tree in document order, with `text` and `label` answering the innermost match when a container echoes a descendant's text. An engine whose tree is the whole truth (a device) calls it; a browser engine reproduces it. A `selector` needs the hook, a `frame` is `FRAME_NOT_FOUND` |
 | `urlMatches(current, expected, baseHref, ignoreCase?)` | `toHaveURL`-style comparison, `ignoreCase` as on the locator matchers; an `expected` that is neither a string nor a `RegExp` throws `INVALID_ARGUMENT`, as in `toTextPattern` |
-| `pollCondition({ deadline, signal, negated, evaluate, onTimeout })`, `Deadline` | Assertion polling and the negation grace window |
+| `pollCondition({ deadline, signal, negated, evaluate, onTimeout })`, `Deadline` | Assertion polling and the negation grace window. An `OPERATION_TIMEOUT` from an `evaluate` that started with under 100 ms of the deadline left, after one that completed, ends the poll: `onTimeout(cause)` builds the failure with it, and a negation passes if it had held long enough by the time that read was cut off. Bound each read `evaluate` makes by `deadline` (`context.operation(deadline.remaining())`): one on the action timeout can outlast the assertion's own |
 | `validateJsonValue(value, label, rules?)` | Checks a value is plain JSON: a top-level `undefined` passes; a non-finite number, a cycle, an object that is not a plain object or array, or a function, symbol, bigint, or `undefined` inside is `INVALID_ARGUMENT` naming `label`. A `Secret` is `POLICY_DENIED` unless `rules.onSecret` throws its own; `rules.maxDepth` caps the nesting |
 | `rejectUnknownKeys(label, value, keys, code?)` | Throws `INVALID_CONFIG` for the first own key of `value` outside `keys`, naming the nearest known key when one is a plausible typo (`web() has unknown key "viewprt"; did you mean "viewport"?`) and the known keys otherwise: the check the runner runs on its own config objects, for an engine factory's options. Pass `'INVALID_ARGUMENT'` as `code` for an object a test passes to a fixture method |
 | `rejectUnknownOptions(api, options, known, code?)` | `INVALID_ARGUMENT` (or `code`, `INVALID_LOCATOR` for a locator option) for an option key a fixture method or matcher does not take, so a JavaScript caller's unsupported option fails instead of running on the default. `options` must be a plain object or `undefined`; a class instance or array is refused, and non-enumerable own keys count as keys |
@@ -1151,16 +1163,16 @@ startedAt }` for `stopVideo` to hand back. A `stop` that throws or returns
 anything else is `ENGINE_FAILURE`, naming the provider and the lease. The
 target argument's type is exported as `ProviderRecordingTarget`.
 
-After a secret fill, the runner redacts every text entry in each trace
-archive and drops its screencast frames: every `screencast/` entry, each
-`screencast-frame` record in a `.trace` entry, and any image a record names.
-After `resolveSecret` returns, it redacts the trace the same way and keeps
-the frames: a trace records the options the engine opened the attempt with,
-and an engine-held secret is protected as text only.
+When the session knows a secret value, the runner redacts every text entry in
+each trace archive, so a value a test spelled into a URL or the options the
+engine opened the attempt with (`resolveSecret`) never stay in it. After a
+secret fill it also drops the screencast frames: every `screencast/` entry,
+each `screencast-frame` record in a `.trace` entry, and any image a record
+names.
 If redaction fails, it deletes the archives and records
 `TRACE_WITHHELD`. Videos are unmasked and carry `redaction: 'incomplete'`.
-A `download` an engine attaches is the app's bytes: after a secret fill or
-once `resolveSecret` returns, the runner rewrites a text one (`.txt`,
+A `download` an engine attaches is the app's bytes: when the session knows
+a secret value, the runner rewrites a text one (`.txt`,
 `.csv`, `.json`, `.html`) through the ledger and labels it `complete`; every
 other download keeps its bytes and carries `redaction: 'incomplete'`.
 

package/docs/reference/environment.mdx

@@ -1,6 +1,7 @@
 ---
 title: Environment variables
 description: Every variable the runner and the first-party engines read, and what each one does.
+icon: "dollar-sign"
 ---
 
 These variables configure the runner and first-party packages. In the tables,
@@ -57,7 +58,6 @@ short would take ordinary text with it.
 | --- | --- | --- |
 | `NO_COLOR` | set | Plain CLI output. Colors are otherwise on for a TTY or in CI and off when piped |
 | `FORCE_COLOR` | set | Colored CLI output even when piped |
-| `NODE_OPTIONS` | value | Inspected for a TypeScript `--import` loader, which decides how the runner registers its own module hooks for `.ts` config and test files |
 | `TERM` | value | `dumb` draws the `e2e init` wordmark at rest, without animation, as in CI |
 | `GITHUB_SHA`, `GITHUB_HEAD_REF`, `GITHUB_REF_NAME` | value | The commit and branch the report records under `run.vcs` when `git` cannot read the project root. `GITHUB_HEAD_REF` wins over `GITHUB_REF_NAME` |
 
@@ -107,6 +107,7 @@ What is sent and how to read it is on the [Telemetry](/telemetry) page.
 | Variable | Reading | Effect |
 | --- | --- | --- |
 | `PLAYWRIGHT_BROWSERS_PATH` | value | Playwright's browser cache, honored by the engine's `prepare` hook |
+| `PLAYWRIGHT_SKIP_BROWSER_GC` | value | Defaults to `1` for the engine's browser install, so it keeps other browsers in the cache. Set `0` to let the install remove them |
 | `KERNEL_API_KEY` | value | The API key `kernel()` from `@e2e-dev/kernel` creates browsers with; unset, the browser lease fails. See [Kernel](/integrations/kernel) |
 | `EXPO_TOKEN` | value | The Expo access token `easSimulators()` from `@e2e-dev/eas` starts and stops simulator sessions with; unset, it uses the eas-cli login in `.expo/state.json` under `HOME` (`USERPROFILE` on Windows), and with neither the device lease fails. See [EAS Simulators](/integrations/eas) |
 | `HOME`, `USERPROFILE` | value | The home `easSimulators()` finds the eas-cli login under when `EXPO_TOKEN` is unset: `USERPROFILE` on Windows, `HOME` elsewhere, the OS user's home when unset |

package/docs/reference/errors.mdx

@@ -1,6 +1,7 @@
 ---
 title: Errors
 description: Every code you can see, its class, and its exit code.
+icon: "triangle-exclamation"
 ---
 
 Every error carries a class. The class determines the exit code; the code
@@ -56,8 +57,8 @@ try {
 | `TEST_SETUP_FAILED` | Test prerequisites outside the product failed to arrange (blocked: test_setup). Also a `test.extend()` fixture that broke its contract: returned without calling `use()`, called it twice, or redefined a fixture the target's engine contributes | configuration | 2 |
 | `AUTOMATION_UNSUPPORTED` | The step needs an interaction the available toolset cannot perform, e.g. drag-and-drop (blocked: automation) | test | 1 |
 | `MODEL_UNAVAILABLE` | No model configured: the built-in agent's `agents.<name>.model` holds no AI SDK model instance; the message names the agent that was selected. Checked once per run when the `agent` fixture is first acquired; recorded as one run-level error that stops the run. `e2e explore` checks before anything starts, a custom executor's entry included, since explore runs the built-in agent. A custom executor without a model is not checked: its `act` and `assert` steps run, and `waitFor` or `extract` fails with this code on its first call. Evicts no [recording](/cache). | configuration | 2 |
-| `POLICY_DENIED` | A denied destination (a navigation scheme other than `http:` or `https:`, `about:blank` aside, a malformed URL), a forbidden fill (an undeclared secret, a non-editable sink, a password into a field that is not a password field), or pixel evidence after a secret fill (`vision: 'only'` with pixels withheld). Also reading a value, text, or attribute from a secure field, the getters and the `toHaveValue`, `toHaveText`, `toContainText`, and `toHaveAttribute` matchers alike. An unknown tool or an undeclared field is refused to the model as the call's result and is not this code | configuration | 2 |
-| `APP_UNREACHABLE` | The app URL could not be reached, or an app command exited early or exceeded `startupTimeout`. The startup error includes recent log output with `command.env` values redacted, and suggests adding a `log` if none is configured. Under the agent, also any engine fault with no more specific code: on a device, an iOS automation runner that is busy or wedged reports here with a message that names the runner, the session and device, and the recovery; see [Testing iOS and Android](/mobile#troubleshooting) | infrastructure | 3 |
+| `POLICY_DENIED` | A denied destination (a navigation scheme other than `http:` or `https:`, `about:blank` aside, a malformed URL), a forbidden fill (an undeclared secret, a non-editable sink, a password into a field that is not a password field), or pixel evidence after a secret fill (`vision: 'only'` with pixels withheld, or an `act` or `vision: true` step whose semantic capture timed out before the step did). Also reading a value, text, or attribute from a secure field, the getters and the `toHaveValue`, `toHaveText`, `toContainText`, and `toHaveAttribute` matchers alike. An unknown tool or an undeclared field is refused to the model as the call's result and is not this code | configuration | 2 |
+| `APP_UNREACHABLE` | The app URL could not be reached, or an app command exited early or exceeded `startupTimeout`. The startup error includes recent log output with `command.env` values redacted, and suggests adding a `log` if none is configured. Under the agent, also any engine fault with no more specific code: on a device, an iOS automation runner that is busy or wedged reports here with a message that names the runner, the session and device, and the recovery; see [Mobile](/mobile#troubleshooting) | infrastructure | 3 |
 | `APP_ALREADY_RUNNING` | `readyUrl` already answered before the target's `app.command` was spawned and `reuseExisting` was not in effect; stop that process or set `reuseExisting: true` locally | infrastructure | 3 |
 | `MODEL_PROVIDER_FAILED` | Provider transport failure (network error, 5xx, rate limit, or a request with no response within 120 s) after the adapter's transport retries (up to 5 per model call, honoring `retry-after`, bounded by the remaining step timeout). A request that stalls is aborted at 120 s and sent again, and an `agent.act` step's `--debug` transcript notes it. The bound covers the whole request, so a model that needs longer than 120 s for one answer fails here too. Evicts no [recording](/cache) | infrastructure | 3 |
 | `CANCELLED` | The runner cancelled the operation, without a process signal: an `e2e mcp` `open_session` whose request the client cancelled or whose connection closed, or that the server's shutdown cut short, after stopping what it had started | infrastructure | 3 |
@@ -83,8 +84,8 @@ These appear in terminal output and in the report as plain string codes.
 | --- | --- | --- | ---: |
 | `CONFIG_NOT_FOUND` | `--config <path>` names a file that does not exist, or no `e2e.config.ts` or `e2e.config.mts` exists from the working directory up to the repository root | configuration | 2 |
 | `CONFIG_AMBIGUOUS` | Both `e2e.config.ts` and `e2e.config.mts` in one directory | configuration | 2 |
-| `CONFIG_LOAD_FAILED` | The config module failed to import: a package that is declared but not installed, an undeclared package, a wrong subpath, a removed export, or any other throw while it evaluates. The message names the fix. A config error raised while it evaluates keeps its own code: an option a factory the config calls (`web()`, `mobile()`, `defineEngine()`) refuses, or a `secrets.get()` handle turned into a string, is `INVALID_CONFIG` | configuration | 2 |
-| `INVALID_CONFIG` | A factory the config module calls (`web()`, `mobile()`, `defineEngine()`) refused its options, with the factory's own message; or an unknown key, out-of-range value, invalid enum, missing `targets`, a target key outside `{ name, platform, engine, app, trace, video }`, a target `app` key that is unknown or malformed, `app` on a target without an engine, a `web()` target without `app.url` or with a device field, a `mobile()` target without `app.bundleId` or `app.appPath`, with `app.url` (not supported yet), a link in `bundleId`, or an unknown permission name or state (the message names the nearest name), an unknown key in a `web()` or `mobile()` option, including `web({ connect })` and `web({ basicAuth })` (the message names the nearest one), a `trace` or `video` that is not a recording mode, the removed artifact kinds list (`artifacts: [...]` or `artifacts.kinds`) and `artifacts.trace` block (the message names the `trace` mode they meant), the removed `artifacts.video` block or `video` artifact kind (the message names the `video` option), the removed `specVersion` key, a `secrets.get()` in an engine option that names no `secrets` entry (a credential's password is not one), a `secrets.get()` reference turned into a string while the config evaluates (a template literal, `String()`) or given where a string is needed (an `app.command` `args` entry or `env` value; only an engine option that declares secrets takes one), an `app.command` `args` entry or `env` value that is not a string (an `undefined` `env` value is dropped instead), an unknown key in `app.command` (the message names the nearest one), an `engine` that is not a `defineEngine` handle, `json` reporter combined with `list`, duplicate or malformed target name, a secret or credential password shorter than 6 characters (code points), two credentials or two secrets whose names map to one `E2E_USER_*` or `E2E_SECRET_*` override variable (`api-key` and `api_key`), oversized `agents.<name>.context`, an `expect.poll` `timeout` or `interval` that is not a finite number of milliseconds, a `tests` value that is not a glob or a list of globs, a `tests` list of only `!` exclusions, the removed top-level `limits` key, an agents entry that is a bare `StepExecutor` (the message names `{ executor }`) or a model instance (the message names `{ model }`), an unknown agent key (the message names the nearest one), the removed agent keys `timeout` and `maxTurns` (the message names `judgmentTimeout` and `maxModelCalls`), `system` or `tools` beside `executor`, a `tools` entry `defineTool` did not build or that takes a built-in tool name (a grammar verb, `complete_step`, `locate`, `start_recording`, `stop_recording`, or `report_finding`), `createToolLoopExecutor({ maxTurns })`, `reuseExisting` on an app whose `app.url` asks for a free port, or a port-0 `app.url` with no `app.command` to serve it | configuration | 2 |
+| `CONFIG_LOAD_FAILED` | The config module failed to import: a package that is declared but not installed, an undeclared package, a wrong subpath, a removed export, or any other throw while it evaluates. The message names the fix. A config error raised while it evaluates keeps its own code: an option a factory the config calls (`web()`, `mobile()`, `defineEngine()`, `decisionExecutor()`) refuses, or a `secrets.get()` handle turned into a string, is `INVALID_CONFIG` | configuration | 2 |
+| `INVALID_CONFIG` | A factory the config module calls (`web()`, `mobile()`, `defineEngine()`, `decisionExecutor()`) refused its options, with the factory's own message; or an unknown key, out-of-range value, invalid enum, missing `targets`, a target key outside `{ name, platform, engine, app, trace, video }`, a target `app` key that is unknown or malformed, `app` on a target without an engine, a `web()` target without `app.url` or with a device field, a `mobile()` target without `app.bundleId` or `app.appPath`, with `app.url` (not supported yet), a link in `bundleId`, or an unknown permission name or state (the message names the nearest name), an unknown key in a `web()` or `mobile()` option, including `web({ connect })` and `web({ basicAuth })` (the message names the nearest one), a `trace` or `video` that is not a recording mode, the removed artifact kinds list (`artifacts: [...]` or `artifacts.kinds`) and `artifacts.trace` block (the message names the `trace` mode they meant), the removed `artifacts.video` block or `video` artifact kind (the message names the `video` option), the removed `specVersion` key, a `secrets.get()` in an engine option that names no `secrets` entry (a credential's password is not one), a `secrets.get()` reference turned into a string while the config evaluates (a template literal, `String()`) or given where a string is needed (an `app.command` `args` entry or `env` value; only an engine option that declares secrets takes one), an `app.command` `args` entry or `env` value that is not a string (an `undefined` `env` value is dropped instead), an unknown key in `app.command` (the message names the nearest one), an `engine` that is not a `defineEngine` handle, `json` reporter combined with `list`, duplicate or malformed target name, a secret or credential password shorter than 6 characters (code points), two credentials or two secrets whose names map to one `E2E_USER_*` or `E2E_SECRET_*` override variable (`api-key` and `api_key`), oversized `agents.<name>.context`, an `expect.poll` `timeout` or `interval` that is not a finite number of milliseconds, a `tests` value that is not a glob or a list of globs, a `tests` list of only `!` exclusions, the removed top-level `limits` key, an agents entry that is a bare `StepExecutor` (the message names `{ executor }`) or a model instance (the message names `{ model }`), an unknown agent key (the message names the nearest one), the removed agent keys `timeout` and `maxTurns` (the message names `judgmentTimeout` and `maxModelCalls`), `system` or `tools` beside `executor`, a `tools` entry `defineTool` did not build or that takes a built-in tool name (a grammar verb, `complete_step`, `locate`, `start_recording`, `stop_recording`, or `report_finding`), `createToolLoopExecutor({ maxTurns })`, `reuseExisting` on an app whose `app.url` asks for a free port, or a port-0 `app.url` with no `app.command` to serve it | configuration | 2 |
 | `CONFIG_NOT_DETERMINISTIC` | A worker re-resolved the config module and got a different digest than the runner | configuration | 2 |
 | `APP_URL_REQUIRED` | A navigation or relative URL on a target that declares no `app.url`, or an `app.command` with no `app.url` or `app.readyUrl` to poll | configuration | 2 |
 | `INVALID_APP_URL` | Base URL with userinfo, a query, a fragment, a non-HTTP scheme, plain HTTP on a non-loopback host, port 0 on a host other than a literal loopback address (`127.0.0.1`, `[::1]`), a loopback address the run could not bind a free port on, or unparseable | configuration | 2 |
@@ -104,24 +105,26 @@ These appear in terminal output and in the report as plain string codes.
 | `NO_LAST_RUN` | `--last-failed` found no `report.json` where the run writes it, or a file there that is not a `report-1` document. Run once without the flag first. | configuration | 2 |
 | `ONLY_IN_CI` | A focused test reached a CI run | configuration | 2 |
 | `COLLECTION_ERROR` | Registration outside collection, an invalid title, a non-function body, an async `describe` body, nested serial groups, an option forbidden inside a serial group, a setup test inside `describe`, an invalid session name, a malformed test option such as `tags` that is not a list of distinct names, a test or `describe` option key the call does not take (the message names the nearest one), a test file that fails to import (in a run with no positionals, or a file the positionals selected), a session that a selected test consumes or `e2e explore --session` names but no collected setup test produces (the message lists the declared sessions), a consumed session on a target whose engine has no `state` capability to save it, or a positional path outside the project root | configuration | 2 |
-| `POLICY_DENIED` | A denied destination (a navigation scheme other than `http:` or `https:`, `about:blank` aside, a malformed URL), a forbidden fill (an undeclared secret, a non-editable sink, a mismatched purpose, a `Secret` reaching a JSON sink), or tainted pixels (`app.screenshot()` after a secret fill, `vision: 'only'` with pixels withheld); see the [security model](/security). An unknown tool or an undeclared field goes back to the model as the call's result, never this code | configuration | 2 |
+| `POLICY_DENIED` | A denied destination (a navigation scheme other than `http:` or `https:`, `about:blank` aside, a malformed URL), a forbidden fill (an undeclared secret, a non-editable sink, a mismatched purpose, a `Secret` reaching a JSON sink), or tainted pixels (`app.screenshot()` after a secret fill, `vision: 'only'` with pixels withheld, an `act` or `vision: true` step whose semantic capture timed out before the step did); see the [security model](/security). An unknown tool or an undeclared field goes back to the model as the call's result, never this code | configuration | 2 |
 | `SESSION_MISMATCH` | A stored session does not match the current run, target, engine, platform, or app identity | configuration | 2 |
 | `SESSION_EXPIRED` | A stored session is past its expiry at restore time (configuration, exit 2), or a setup test saved state whose expiry is not after its creation (test, exit 1) | configuration or test | 2 or 1 |
 | `SESSION_INVALID` | A stored session failed authentication. Tampered or corrupt. | configuration | 2 |
 | `SESSION_UNAVAILABLE` | A test requires a session no selected setup test produced | configuration | 2 |
 | `SESSION_CONTRACT` | A setup test saved a session twice, saved an undeclared name, or finished without saving a declared one | test | 1 |
-| `TEST_TIMEOUT` | The attempt exceeded the resolved test `timeout`. The body is not stopped: the harness operation it is in is cancelled and its fixtures die with the attempt, so it cannot reach the next test | test | 1 |
+| `TEST_TIMEOUT` | The attempt exceeded the resolved test `timeout`. The body is not stopped: the harness operation it is in is cancelled and its fixtures die with the attempt, so it cannot reach the next test. A test that blocks the event loop gets its worker killed once `cleanupTimeout` (at least 5 s) passes after the timeout; see [Hooks](/reference/test#hooks) | test | 1 |
 | `STEP_NOT_AWAITED` | The test body settled while a step it started was still running: a step call without `await`. The step is failed at the line of the call and cancelled; the attempt fails with this code when the body returned, or keeps the body's own error and records this one under `secondaryErrors` when the body threw. An `expect.poll` matcher left running when the body, an `afterEach` hook, or a fixture teardown returned fails that phase the same way at the line of the call, and is cancelled; one left by a `beforeAll` or `afterAll` hook fails the hook with `HOOK_FAILED` | test | 1 |
 | `UNHANDLED_REJECTION` | A promise rejected with no test running. An unhandled rejection is charged to the test running when it surfaces, since Node cannot say which test created the promise; between tests it is this run error, naming the last test that finished in the worker as the likely source. Before any test has finished in the worker it ends the worker instead: the rejection is the run error and the test on its way fails with `WORKER_CRASH`. The body that left it keeps running like one past `TEST_TIMEOUT` | test | 1 |
 | `HOOK_FAILED` | `beforeAll` or `afterAll` threw. Skips the suite's tests. | test | 1 |
 | `LAUNCH_TIMEOUT` | Engine init or attempt start exceeded `config.launchTimeout` | infrastructure | 3 |
 | `CLEANUP_TIMEOUT` | Engine attempt end exceeded `config.cleanupTimeout`, or a route or dialog handler the engine ran for the test was still running when the attempt settled | infrastructure | 3 |
-| `TRACE_WITHHELD` | A trace from an attempt a secret reached (filled, or held by the engine) could not be rewritten, so it was deleted. Recorded in the attempt's `secondaryErrors`; never fails the attempt. | infrastructure | 3 |
+| `TRACE_WITHHELD` | A trace from a session that knows a secret value could not be rewritten, so it was deleted, or the engine returned an archive path outside the attempt's artifact directory, so nothing was registered. Recorded in the attempt's `secondaryErrors`; never fails the attempt. | infrastructure | 3 |
 | `BROWSER_INSTALL_FAILED` | Browser provisioning failed | infrastructure | 3 |
 | `WORKER_INIT_FAILED` | A worker process never became ready | infrastructure | 3 |
-| `WORKER_EXIT` | A worker exited unexpectedly while running a file: the test in flight fails with `WORKER_CRASH` and the file's other tests are skipped. An unhandled rejection is charged to the test running when it surfaces, or recorded as `UNHANDLED_REJECTION` between tests; before any test has finished there it ends the worker, and the rejection itself is the run error, not this one | infrastructure | 3 |
+| `WORKER_EXIT` | A worker exited unexpectedly while running a file: the test in flight fails with `WORKER_CRASH` and the file's other tests are skipped. Attempts that finished before the exit stay in the report, a retry's earlier attempts and a serial group's finished members included, and the crash is recorded as the attempt after them, or on the last attempt when it came after it (an `afterAll`). An unhandled rejection is charged to the test running when it surfaces, or recorded as `UNHANDLED_REJECTION` between tests; before any test has finished there it ends the worker, and the rejection itself is the run error, not this one | infrastructure | 3 |
 | `WORKER_CRASH` | A worker exited during a specific test | infrastructure | 3 |
 | `WORKER_ENTRY_MISSING` | The worker entry module could not be resolved. Packaging fault. | infrastructure | 3 |
+| `NODE_UNSUPPORTED` | The runtime cannot run e2e's TypeScript loader: a Node.js outside `^22.22.3 \|\| >=24.8.0`, Bun (no `module.registerHooks`), or Deno. The CLI checks this before it starts and exits 2 with the same sentence; the loader checks it again where it registers its hooks, for a host that runs e2e's runner without the CLI | infrastructure | 3 |
+| `TYPESCRIPT_COMPILER_UNAVAILABLE` | oxc, which compiles e2e's TypeScript, could not be loaded; the message gives the cause. Most often its native bindings for this platform (`@oxc-transform/binding-<platform>-<arch>`, `@oxc-parser/binding-<platform>-<arch>`) are not installed. npm leaves it out with `--omit=optional`, or when `package-lock.json` was written on another platform (npm/cli#4828): install again without `--omit=optional`, or delete `package-lock.json` and `node_modules` and run `npm install` | infrastructure | 3 |
 | `ENGINE_FAILURE` | Any engine fault with no more specific mapping | infrastructure | 3 |
 | `WORKER_PROTOCOL` | A worker reported a unit other than the one it was running, or started an attempt while another was still running | infrastructure | 3 |
 | `SESSION_KEY_INVALID` | A worker received a session key that is not 32 bytes. Packaging or IPC fault. | infrastructure | 3 |

package/docs/reference/expect.mdx

@@ -1,6 +1,7 @@
 ---
 title: expect
 description: "Locator assertions, fixture assertions, and plain value matchers."
+icon: "circle-check"
 ---
 
 Use `expect(locator)` to wait for an app condition and `expect(value)` to
@@ -370,7 +371,7 @@ The unit-runner matchers (`toThrow`, `toBeInstanceOf`, `toBeNaN`,
 `toStrictEqual`, `resolves`, `rejects`, `expect.extend`) are not part of
 `expect`. An end-to-end test checks what the app shows and what its API
 returns; the value matchers cover that, see
-[Testing APIs](/api-testing). Code-level
+[API](/api-testing). Code-level
 checks belong in the unit runner.
 
 Pass a second argument to describe the check in its failure message:

package/docs/reference/mcp.mdx

@@ -1,19 +1,20 @@
 ---
 title: MCP server (e2e mcp)
 description: Let a coding agent inspect and interact with your app over MCP.
+icon: "plug"
 ---
 
 <CodeGroup>
 ```bash npm
-npx e2e mcp [--config <path>] [--target <name>] [--headless] [--max-sessions <n>]
+npx e2e mcp [--config <path>] [--target <name>] [--headed] [--max-sessions <n>]
 ```
 
 ```bash pnpm
-pnpm exec e2e mcp [--config <path>] [--target <name>] [--headless] [--max-sessions <n>]
+pnpm exec e2e mcp [--config <path>] [--target <name>] [--headed] [--max-sessions <n>]
 ```
 
 ```bash bun
-bunx e2e mcp [--config <path>] [--target <name>] [--headless] [--max-sessions <n>]
+bunx e2e mcp [--config <path>] [--target <name>] [--headed] [--max-sessions <n>]
 ```
 </CodeGroup>
 
@@ -64,21 +65,32 @@ Start the server in the project directory. Config discovery works like
 | --- | --- |
 | `--config <path>` | The config every session loads unless `open_session` names one. Configs are reloaded on every `open_session`, with every file they import by path. |
 | `--target <name>` | The target every session opens on. Otherwise `open_session` names one, or the only target is used; several targets and no name is `TARGET_REQUIRED`. |
-| `--headless` | Hide the browser or simulator. Sessions are headed by default outside CI. |
+| `--headed` | Show the browser or simulator, when the engine supports it, in every session whose `open_session` does not set `headed`. Sessions are headless by default, as in `e2e run`. |
 | `--max-sessions <n>` | How many sessions may be open at once, 1 through 16; default 4. Each session is its own browser or device. |
 
 Operator output goes to stderr, prefixed `e2e mcp:`. Stdout carries only the
-protocol; anything a config module writes to stdout is redirected.
+protocol. What your code writes through `console`, `process.stdout`, or
+`process.stderr` (the config's top-level code, project tools) goes to stderr
+with secret values redacted. Output printed while a config loads appears once
+it has loaded; if the load fails, that output is withheld, since the config's
+secrets are unknown. An error nobody caught is logged redacted and shuts the
+server down. A child process that inherits the server's stdio writes past
+this.
 
 ## Tools
 
 | Tool | Arguments | Result |
 | --- | --- | --- |
-| `open_session` | `target` (optional), `config` (optional path) | Loads the config, starts the target's app command, boots the engine, starts one attempt, opens the app URL when the engine can navigate. Returns the session id, the catalog, and the first observation. |
+| `open_session` | `target` (optional), `config` (optional path), `headed` (optional boolean) | Loads the config, starts the target's app command, boots the engine, starts one attempt, opens the app URL when the engine can navigate. Returns the session id, the catalog, and the first observation. `headed: true` shows this session's browser or simulator, `false` hides it; without it the session follows `--headed`. |
 | `tools` | `tool` (optional), `session` (required while several are open) | The catalog, one line per tool. With `tool`, its full description and argument schema. |
 | `call` | `tool`, `args` (optional), `session` (required while several are open) | Runs one catalog tool. Arguments are validated against the tool's closed schema first: a wrong type or an argument the tool does not declare is `INVALID_ARGUMENT`, and nothing runs. An action that fails is an error result that still carries the screen it re-observed, and leads with the tool, its target, and the code: `navigate file:///etc/passwd failed: POLICY_DENIED: forbidden URL scheme: file:`. |
 | `close_session` | `session` (required while several are open) | Saves a recording still running, ends the attempt, disposes the engine, stops the app processes the session started once no other session uses them. |
 
+Project tools honor their AI SDK `toModelOutput` renderer, including when
+`execute` returns a string. Rendered `error-text` and `error-json` outputs
+are MCP error results (`isError: true`) so the coding agent can distinguish
+a failed tool call from a successful one.
+
 ## Several sessions
 
 Several sessions can be open at once, up to `--max-sessions`, each on its
@@ -183,8 +195,9 @@ Sessions enforce what tests enforce. Node ids are valid only against the
 newest observation. A secret fills only through `type_secret`; once one has
 been filled, `screenshot` and the point tools (`tap_at`, `hover_at`,
 `type_at`, `press_at`, `select_at`) stay in the catalog but answer
-`PIXEL_TAINTED` for the rest of the session. Every text a `call` returns, a node `locate` found,
-an action's result, or an error, passes the attempt's secret ledger. Nothing a
+`PIXEL_TAINTED` for the rest of the session. Every text a tool returns, a node `locate` found,
+an action's result, an `open_session` or `close_session` failure, or a cleanup line, has the
+config's secret values redacted once the config has loaded, as do the server's own log lines. Nothing a
 session does is recorded as a test result or into the replay cache; its
 artifacts land under `<output>/artifacts/<target>/sessions/`, its videos under
 `<output>/videos/`. A later `e2e run` clears `<output>/artifacts`; the

package/docs/reference/mobile.mdx

@@ -1,6 +1,7 @@
 ---
 title: Mobile
 description: Mobile engine options and the device fixture for iOS and Android.
+icon: "mobile-screen"
 ---
 
 `@e2e-dev/mobile` drives iOS simulators, Android emulators, and connected

package/docs/reference/reporters.mdx

@@ -1,6 +1,7 @@
 ---
 title: Reporters
 description: Receive run events and publish results with a custom reporter.
+icon: "file-lines"
 ---
 
 Add reporter objects to `reporters` in `e2e.config.ts`, alongside the

package/docs/reference/screen.mdx

@@ -1,6 +1,7 @@
 ---
 title: screen and Locator
 description: Queries, refinement, actions, and reads.
+icon: "display"
 ---
 
 A `Locator` stores a query and resolves it when an action, read, or assertion
@@ -178,14 +179,15 @@ not the finger: `'down'` reveals what is below. `momentum` is its fling
 strength, `'none'` by default: `'none'` a plain drag of half the surface,
 `'slow'` a short fling, `'fast'` a long one. How far each carries is the
 engine's.
-`{ from, to }` is a swipe along a path between two viewport points: a touch
-swipe on a device, a pointer drag on a document platform, which is what
-reveals a row action, dismisses a sheet, or drags a card between columns.
-Uses `config.actionTimeout`. Throws
-`ACTION_FAILED` when the gesture is rejected, `INVALID_ARGUMENT` for a mix
-of the two shapes or a coordinate off the plane, and `UNSUPPORTED_CAPABILITY`
-when the engine does not list `swipe` in its actions (a direction) or
-`swipeTo` in its pointer actions (a path).
+`{ from, to, duration? }` is a swipe along a path between two viewport points:
+a touch swipe on a device, a pointer drag on a document platform, which is
+what reveals a row action, dismisses a sheet, or drags a card between
+columns. `duration` sets how long the gesture takes in milliseconds; omitted
+leaves the duration to the engine's default. Uses `config.actionTimeout`.
+Throws `ACTION_FAILED` when the gesture is rejected, `INVALID_ARGUMENT` for
+a mix of the two shapes, an out-of-range duration, or a coordinate off the
+plane, and `UNSUPPORTED_CAPABILITY` when the engine does not list `swipe` in
+its actions (a direction) or `swipeTo` in its pointer actions (a path).
 
 ```ts
 await screen.swipe({ direction: 'up', momentum: 'fast' });
@@ -194,6 +196,7 @@ const row = await screen.getByText('Design review').boundingBox();
 await screen.swipe({
   from: { x: row.x + row.width - 10, y: row.y + row.height / 2 },
   to: { x: row.x + 10, y: row.y + row.height / 2 },
+  duration: 300,
 });
 ```
 
@@ -585,6 +588,7 @@ export interface SwipeOptions {
   momentum?: Momentum;
   from?: never;
   to?: never;
+  duration?: never;
 }
 
 /** A swipe along a path between two viewport points: a touch swipe on a device, a pointer drag on a document platform. */
@@ -593,6 +597,8 @@ export interface SwipePathOptions {
   from: Point;
   /** Where it lifts. */
   to: Point;
+  /** Gesture duration in milliseconds; omitted = the engine's default. */
+  duration?: number;
   direction?: never;
   momentum?: never;
 }
@@ -663,7 +669,11 @@ and `<details>` are `group`, `<input type="number">` is `spinbutton`,
 `<select size="3">` is a `listbox` like a `multiple` one, an `<input list>`
 naming a `<datalist>` is a `combobox`, a `<td>` of a `role="grid"` table is a
 `gridcell`,
-`<thead>` and `<tbody>` are `rowgroup`, `<th scope="row">` is `rowheader`,
+`<thead>` and `<tbody>` are `rowgroup`, `<th scope="row">` is `rowheader`.
+A scope-less `<th>` beside a data cell with text or children is also a
+`rowheader`; header-only rows keep `columnheader`. A lone scope-less header in a one-row
+table has no header role, while `scope="col"` and `scope="colgroup"` explicitly
+keep `columnheader`.
 `<figure>` is `figure`, `<article>` is `article`, `<header>` and `<footer>` are
 `banner` and `contentinfo` only outside sectioning content or an element with
 a sectioning role (`article`, `complementary`, `main`, `navigation`, `region`),

package/docs/reference/test.mdx

@@ -1,6 +1,7 @@
 ---
 title: test
 description: Tests, setup tests, groups, hooks, options, and fixtures.
+icon: "flask-vial"
 ---
 
 Declare tests, groups, and hooks synchronously while the test file is
@@ -192,6 +193,19 @@ for every scope whose `beforeAll` started.
 its own `cleanupTimeout` budget with working fixtures, so teardown can still
 drive the app after the body timed out.
 
+A test that blocks its worker's event loop (`while (true) {}` in a fixture,
+`beforeEach`, the body, or `afterEach`) stops every timer in that worker, so
+the worker cannot time it out. A `beforeAll` or `afterAll` that blocks still
+hangs the run. When the worker has not responded `cleanupTimeout` (at least 5 s) after
+the test timeout, the runner kills it. That attempt is reported `timed-out`
+with `TEST_TIMEOUT` and no artifacts, after the attempts before it, and is
+not retried. The rest of its file runs on a new worker. In a serial group,
+the members after it are skipped. A worker with a debugger attached when the
+test starts (an editor's auto-attach, or `NODE_OPTIONS=--inspect=0`) is
+never killed this way, so a breakpoint can stay paused. A programmatic run with an inline
+config or in-memory tests runs in the runner's own process and has no worker
+to kill: a blocked event loop hangs it.
+
 A throw inside `beforeAll` or `afterAll` is `HOOK_FAILED` and skips the
 suite's tests with cause `hook-failed`. Inside a serial group it skips every
 remaining member and fails the group without a retry.
@@ -302,7 +316,13 @@ group's attempt. A retry starts fresh. Inside it, `retries`, `trace`,
 `video`, `session`, `platforms`, `requires`, `skip`, `only`, and a nested
 `serial` on a member are collection errors. Set them on the group. The group
 records one trace and one video per group attempt, from the `trace` and
-`video` on the serial `describe` or a group around it.
+`video` on the serial `describe` or a group around it. A group attempt that
+cannot start, because its file fails to load or its session fails to launch,
+fails the first member with that error and skips the rest with cause
+`serial-predecessor-failed`. When the run is interrupted during the launch,
+every member skips instead. On a retry, the members keep the verdicts of
+the attempt before it. The exit code follows the error's category, as for any
+other test.
 
 ## Fixtures
 

package/docs/reference/web.mdx

@@ -1,6 +1,7 @@
 ---
 title: Browser
 description: The browser engine, its options, and the browser fixture it contributes.
+icon: "globe"
 ---
 
 `@e2e-dev/web` drives Chromium, Firefox, and WebKit through Playwright.
@@ -162,7 +163,7 @@ That protection is text only: unlike a fill, it withholds no screenshot or
 model pixels, so a page that renders the password on screen is not masked in
 them ([Security](/security#secrets)).
 
-`headers` and `basicAuth` are how a test reaches a [protected preview](/starting-your-app#protected-previews).
+`headers` and `basicAuth` are how a test reaches a [protected preview](/web#protected-previews).
 
 `screencast` shapes the recording, not which attempts record: that is the
 config's [`video`](/reference/config#video) mode. `size` takes whole pixels,
@@ -291,7 +292,7 @@ export interface Browser extends Expectable<BrowserExpectation> {
   locator(selector: string): Locator;
   /** Creates a screen query scope inside one iframe. */
   frameLocator(selector: string): FrameScreen;
-  /** Evaluates trusted test code in the page. */
+  /** Evaluates trusted test code in the page: a function, or a string expression whose value is returned, called first if it is a function. */
   evaluate<T extends JsonValue>(fn: string | (() => T | Promise<T>)): Promise<T>;
   /** Evaluates trusted test code with one required JSON-safe argument. */
   evaluate<T extends JsonValue, Arg extends JsonValue>(
@@ -428,6 +429,10 @@ close over anything outside its own body; helpers declared inside the body
 work. Pass outside values through `arg`. Both `arg` and the return value
 must be `JsonValue`, otherwise the call fails with `INVALID_ARGUMENT`.
 
+A string is evaluated as a single expression, not as statements. If it
+evaluates to a function, that function is called with `arg`; otherwise its
+value is the result. A promise, from either, is awaited.
+
 An exception in the evaluated code is `EVALUATE_FAILED` with its message. A
 Playwright timeout is `ACTION_FAILED`; a closed page or lost context is
 `ENGINE_FAILURE`.
@@ -438,6 +443,7 @@ const flag = await browser.evaluate(
   (name: string) => window.localStorage.getItem(name),
   'featureFlags',
 );
+const title = await browser.evaluate<string>('document.title');
 ```
 
 ### Init scripts