jourilo 1.2.0 → 1.2.1

package/plugin/dist/jourilo.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Jourilo 1.2.0 - generated by scripts/build.mjs. Do not edit; edit src/ instead.
+// Jourilo 1.2.1 - generated by scripts/build.mjs. Do not edit; edit src/ instead.
 import { createRequire as __jouriloCreateRequire } from 'node:module';
 const require = __jouriloCreateRequire(import.meta.url);
 var __create = Object.create;
@@ -1096,23 +1096,23 @@ var require_axe = __commonJS({
             }
             function publish(promise) {
               var subscribers = promise._subscribers;
-              var settled = promise._state;
+              var settled2 = promise._state;
               if (subscribers.length === 0) {
                 return;
               }
               var child = void 0, callback = void 0, detail = promise._result;
               for (var i2 = 0; i2 < subscribers.length; i2 += 3) {
                 child = subscribers[i2];
-                callback = subscribers[i2 + settled];
+                callback = subscribers[i2 + settled2];
                 if (child) {
-                  invokeCallback(settled, child, callback, detail);
+                  invokeCallback(settled2, child, callback, detail);
                 } else {
                   callback(detail);
                 }
               }
               promise._subscribers.length = 0;
             }
-            function invokeCallback(settled, promise, callback, detail) {
+            function invokeCallback(settled2, promise, callback, detail) {
               var hasCallback = isFunction(callback), value = void 0, error = void 0, succeeded = true;
               if (hasCallback) {
                 try {
@@ -1133,9 +1133,9 @@ var require_axe = __commonJS({
                 resolve10(promise, value);
               } else if (succeeded === false) {
                 reject(promise, error);
-              } else if (settled === FULFILLED) {
+              } else if (settled2 === FULFILLED) {
                 fulfill(promise, value);
-              } else if (settled === REJECTED) {
+              } else if (settled2 === REJECTED) {
                 reject(promise, value);
               }
             }
@@ -38823,7 +38823,7 @@ var require_axe = __commonJS({
 init_errors();
 
 // src/core/version.ts
-var VERSION = true ? "1.2.0" : "0.0.0-dev";
+var VERSION = true ? "1.2.1" : "0.0.0-dev";
 
 // src/cli/framework.ts
 init_errors();
@@ -38877,6 +38877,26 @@ function num(ctx, key, fallback) {
     throw new JouriloError("USAGE", `--${key} must be a non-negative number.`);
   return n;
 }
+function pagesOption(ctx, fallback) {
+  const v = str(ctx, "pages");
+  if (v === void 0) return fallback;
+  const n = Number(v);
+  if (v.trim() === "" || !Number.isInteger(n) || n < 1)
+    throw new JouriloError("USAGE", `--pages must be a whole number of 1 or more (got "${v}").`);
+  return n;
+}
+var MAX_DURATION_LIMIT_S = 86400;
+function maxDurationOption(ctx) {
+  const v = str(ctx, "max-duration");
+  if (v === void 0) return void 0;
+  const n = Number(v);
+  if (v.trim() === "" || !Number.isFinite(n) || n < 1 || n > MAX_DURATION_LIMIT_S)
+    throw new JouriloError(
+      "USAGE",
+      `--max-duration must be from 1 to ${MAX_DURATION_LIMIT_S} seconds (got "${v}").`
+    );
+  return n;
+}
 function list(ctx, key) {
   const v = ctx.values[key];
   if (Array.isArray(v))
@@ -38917,6 +38937,29 @@ function parseStateOptions(ctx) {
 function flag(ctx, key) {
   return ctx.values[key] === true;
 }
+function denyLocalFrom(ctx) {
+  if (flag(ctx, "deny-local")) return true;
+  const raw = process.env.JOURILO_DENY_LOCAL ?? "";
+  const v = raw.trim().toLowerCase();
+  if (!v || ["0", "false", "no", "off"].includes(v)) return false;
+  if (["1", "true", "yes", "on"].includes(v)) return true;
+  if (!warnedDenyLocal) {
+    warnedDenyLocal = true;
+    ctx.log(
+      `JOURILO_DENY_LOCAL=${raw} is not recognised (use 1, true, yes or on to enable, 0, false, no or off to disable); --deny-local is on.`
+    );
+  }
+  return true;
+}
+var warnedDenyLocal = false;
+function refuseDenyLocalWebkit(denyLocal, browser) {
+  if (denyLocal && browser === "webkit")
+    throw new JouriloError(
+      "UNSAFE_URL",
+      "--deny-local cannot be combined with --browser webkit: WebKit sends HTTPS redirects outside the network guard, so a redirect to a local address could not be blocked.",
+      "Use --browser chromium or firefox."
+    );
+}
 function requirePositional(ctx, index, name, usage2) {
   const v = ctx.positionals[index];
   if (!v) throw new JouriloError("USAGE", `Missing <${name}>.`, `Usage: ${usage2}`);
@@ -39073,7 +39116,7 @@ Re-run with --write to install.`
 };
 
 // src/cli/commands/audit.ts
-import { existsSync as existsSync12, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync12, writeSync as writeSync2 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 
 // src/audit/engine.ts
@@ -39597,8 +39640,16 @@ function lexiconSource(concept, opts = {}) {
   if (opts.exact) return `^\\s*(?:${alt})\\s*[.!\u2026]?\\s*$`;
   return `(?<![\\p{L}\\p{N}])(?:${alt})${STEMS.has(concept) ? "" : "(?![\\p{L}\\p{N}])"}`;
 }
+function turkishFold(text) {
+  return text.replace(/İ/g, "i").replace(/I/g, "\u0131").toLowerCase();
+}
+var LexiconRegExp = class extends RegExp {
+  test(text) {
+    return super.test(text) || super.test(turkishFold(text));
+  }
+};
 function lexicon(concept, opts = {}) {
-  return new RegExp(lexiconSource(concept, opts), "iu");
+  return new LexiconRegExp(lexiconSource(concept, opts), "iu");
 }
 function lexiconSources() {
   return Object.fromEntries(Object.keys(LEX).map((k) => [k, lexiconSource(k)]));
@@ -39613,11 +39664,12 @@ import net, { isIP as isIP2 } from "node:net";
 
 // src/core/url-safety.ts
 init_errors();
+import { execFile } from "node:child_process";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 var LOCAL_SUFFIXES = [".localhost", ".test"];
 function isLocalHostname(host) {
-  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase().replace(/\.$/, "");
   return h === "localhost" || h === "::1" || /^127\.\d+\.\d+\.\d+$/.test(h) || h === "0.0.0.0" || LOCAL_SUFFIXES.some((s) => h.endsWith(s));
 }
 var METADATA_V4 = /* @__PURE__ */ new Set(["169.254.169.254", "169.254.170.2", "169.254.169.123", "100.100.100.200"]);
@@ -39685,7 +39737,7 @@ function classifyIp(ip) {
   if (family === 6) return classifyV6(v);
   return "reserved";
 }
-function addressVerdict(ip, policy) {
+function addressVerdict(ip, policy, port) {
   const cls = classifyIp(ip);
   switch (cls) {
     case "public":
@@ -39698,6 +39750,8 @@ function addressVerdict(ip, policy) {
     case "reserved":
       return { ok: false, reason: `${ip} is a reserved or special-purpose address.` };
     case "loopback":
+      if (policy.denyLocal && !(port !== void 0 && policy.allowLoopbackPorts?.includes(port) && ip === "127.0.0.1"))
+        return { ok: false, reason: `${ip} is this machine (loopback) and --deny-local is set.` };
       return policy.target === "local" || policy.allowPrivate ? { ok: true } : { ok: false, reason: `${ip} is this machine (loopback); a public target may not reach it.` };
     default:
       return policy.allowPrivate ? { ok: true } : {
@@ -39720,27 +39774,85 @@ function parseTargetUrl(raw) {
   return url;
 }
 var systemResolver = (host) => lookup(host, { all: true, verbatim: true });
+var RESOLVE_TIMEOUT_MS = 5e3;
+function withTimeout(work, ms, message) {
+  let timer;
+  const limit = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(message)), ms);
+    timer.unref();
+  });
+  return Promise.race([work, limit]).finally(() => clearTimeout(timer));
+}
+var LookupFailed = class extends Error {
+};
+function resolveInChild(host, ms, exec = execFile) {
+  const script = "require('node:dns').lookup(process.env.JOURILO_RESOLVE_HOST,{all:true,verbatim:true},(e,a)=>{if(e)process.exit(2);process.stdout.write(JSON.stringify(a),()=>process.exit(0))})";
+  const env = { ...process.env, NODE_OPTIONS: "", JOURILO_RESOLVE_HOST: host };
+  return new Promise((resolve10, reject) => {
+    try {
+      exec(process.execPath, ["-e", script], { timeout: ms, encoding: "utf8", env }, (err, stdout) => {
+        if (err) {
+          if (err.killed || err.code === 2) return reject(new LookupFailed(`DNS lookup failed for ${host}`));
+          return resolve10([]);
+        }
+        try {
+          resolve10(JSON.parse(stdout));
+        } catch {
+          resolve10([]);
+        }
+      });
+    } catch {
+      resolve10([]);
+    }
+  });
+}
+var DENY_LOCAL_HINT = "Unset --deny-local / JOURILO_DENY_LOCAL to audit a local development server, or pass a public URL.";
 var PRIVATE_HINT = "Pass --allow-private if you are authorized to test this host.";
 async function checkTarget(url, opts = {}) {
+  return (await checkTargetDetailed(url, { ...opts, resolveLocalNames: false })).hostClass;
+}
+async function checkTargetDetailed(url, opts = {}) {
   const host = url.hostname.replace(/^\[|\]$/g, "");
   const literal = isIP(host) !== 0;
+  if (opts.denyLocal && (isLocalHostname(host) || literal && classifyIp(host) === "loopback"))
+    throw new JouriloError(
+      "UNSAFE_URL",
+      `${host} is a local address and --deny-local is set.`,
+      DENY_LOCAL_HINT
+    );
   if (literal) {
     const cls = classifyIp(host);
     if (cls === "metadata" || cls === "reserved" && host !== "0.0.0.0")
       throw new JouriloError("UNSAFE_URL", `${host} is a ${cls} address; Jourilo does not audit it.`);
-    if (cls === "loopback") return "local";
-    if (cls === "public") return "public";
+    if (cls === "loopback") return { hostClass: "local" };
+    if (cls === "public") return { hostClass: "public" };
     if (!opts.allowPrivate)
       throw new JouriloError("UNSAFE_URL", `${host} is a private network address.`, PRIVATE_HINT);
-    return "private";
+    return { hostClass: "private" };
   }
-  if (isLocalHostname(host)) return "local";
-  if (opts.resolveDns === false) return "public";
+  if (isLocalHostname(host)) {
+    const h = host.toLowerCase();
+    const needsLookup = LOCAL_SUFFIXES.some((x) => x !== ".localhost" && h.endsWith(x));
+    if (opts.resolveDns === false || opts.resolveLocalNames === false || !needsLookup)
+      return { hostClass: "local" };
+    try {
+      const limit = opts.resolveTimeoutMs ?? RESOLVE_TIMEOUT_MS;
+      await withTimeout(
+        opts.resolver ? opts.resolver(host) : resolveInChild(host, limit),
+        limit,
+        `DNS lookup failed for ${host} (timed out)`
+      );
+    } catch {
+      return { hostClass: "local", unresolved: true };
+    }
+    return { hostClass: "local" };
+  }
+  if (opts.resolveDns === false) return { hostClass: "public" };
   let addrs;
   try {
     addrs = await (opts.resolver ?? systemResolver)(host);
   } catch {
-    return "public";
+    return { hostClass: "public" };
   }
   const classes = addrs.map((a) => ({ address: a.address, cls: classifyIp(a.address) }));
   const forbidden = classes.find((c) => c.cls === "metadata" || c.cls === "reserved");
@@ -39749,8 +39861,17 @@ async function checkTarget(url, opts = {}) {
       "UNSAFE_URL",
       `${host} resolves to ${forbidden.address}, a ${forbidden.cls} address; Jourilo does not audit it.`
     );
+  if (opts.denyLocal) {
+    const loop = classes.find((c) => c.cls === "loopback");
+    if (loop)
+      throw new JouriloError(
+        "UNSAFE_URL",
+        `${host} resolves to ${loop.address}, a local address, and --deny-local is set.`,
+        DENY_LOCAL_HINT
+      );
+  }
   const nonPublic = classes.filter((c) => c.cls !== "public");
-  if (!nonPublic.length) return "public";
+  if (!nonPublic.length) return { hostClass: "public" };
   if (!opts.allowPrivate) {
     const mixed = nonPublic.length < classes.length;
     throw new JouriloError(
@@ -39759,7 +39880,7 @@ async function checkTarget(url, opts = {}) {
       PRIVATE_HINT
     );
   }
-  return "private";
+  return { hostClass: "private" };
 }
 function isCrawlable(candidate, origin) {
   let u;
@@ -39782,6 +39903,10 @@ function normalizeForCrawl(raw) {
   u.hash = "";
   for (const k of [...u.searchParams.keys()])
     if (/^utm_|^(fbclid|gclid|ref)$/i.test(k)) u.searchParams.delete(k);
+  return u.toString();
+}
+function crawlKey(url) {
+  const u = new URL(normalizeForCrawl(url));
   if (u.pathname !== "/" && u.pathname.endsWith("/")) u.pathname = u.pathname.replace(/\/+$/, "");
   return u.toString();
 }
@@ -39795,12 +39920,16 @@ var systemResolve = (host) => new Promise(
 );
 async function resolveAllowed(host, port, policy, deps = {}) {
   const h = host.replace(/^\[|\]$/g, "");
-  const verdict = deps.verdict ?? ((ip) => addressVerdict(ip, policy));
+  const verdict = deps.verdict ?? ((ip, port2) => addressVerdict(ip, policy, port2));
   let addrs;
   if (isIP2(h)) addrs = [{ address: h, family: isIP2(h) }];
   else {
     try {
-      addrs = await (deps.resolve ?? systemResolve)(h);
+      addrs = await withTimeout(
+        (deps.resolve ?? systemResolve)(h),
+        deps.resolveTimeoutMs ?? RESOLVE_TIMEOUT_MS,
+        `DNS lookup failed for ${h} (timed out)`
+      );
     } catch (err) {
       throw Object.assign(new Error(`DNS lookup failed for ${h}`), { cause: err });
     }
@@ -39855,6 +39984,14 @@ function loopbackRedirectVerdict(location, from, policy) {
   } catch {
     return null;
   }
+  if (policy.denyLocal) {
+    const h = to.hostname.replace(/^\[|\]$/g, "").toLowerCase().replace(/\.$/, "");
+    const local = isLocalHostname(h) || isIP2(h) !== 0 && classifyIp(h) === "loopback";
+    const port = Number(to.port || (to.protocol === "https:" ? 443 : 80));
+    const own = policy.allowLoopbackPorts?.includes(port) && h === "127.0.0.1";
+    if (local && !own)
+      return `redirect from ${from.host} to ${to.host} (a local address) refused: --deny-local is set.`;
+  }
   if (!isLoopbackName(to.hostname)) return null;
   if (policy.target === "local" || policy.allowPrivate) return null;
   return `redirect from ${from.host} to ${to.host} (this machine) refused.`;
@@ -39888,8 +40025,9 @@ async function startNetGuard(policy, deps = {}) {
   };
   const sockets = /* @__PURE__ */ new Set();
   const track = (s) => {
+    if (sockets.has(s)) return s;
     sockets.add(s);
-    s.on("close", () => sockets.delete(s));
+    s.once("close", () => sockets.delete(s));
     return s;
   };
   const connectUpstream = (host, port2, onReady, onFail) => {
@@ -39966,7 +40104,13 @@ async function startNetGuard(policy, deps = {}) {
           res.writeHead(up.statusCode ?? 502, up.statusMessage, out);
           up.pipe(res);
         });
-        upstream.on("error", (err) => fail(502, err.message));
+        upstream.on("socket", (s) => track(s));
+        res.on("close", () => {
+          if (!res.writableFinished) upstream.destroy();
+        });
+        upstream.on("error", (err) => {
+          if (!res.destroyed) fail(502, err.message);
+        });
         req.pipe(upstream);
       },
       (err) => fail(502, err.message)
@@ -40830,12 +40974,15 @@ var probe_default = `// Runs inside the audited page. Plain JavaScript (no impor
   for (const fs of document.querySelectorAll('fieldset')) {
     if (!isVisible(fs)) continue;
     const legend = fs.querySelector(':scope > legend');
-    if (!legend || !text(legend))
-      structure.fieldsets.push({
-        selector: selectorOf(fs),
-        rect: rectOf(fs),
-        issue: legend ? 'empty legend' : 'no legend',
-      });
+    if (legend && text(legend)) continue;
+    if ((fs.getAttribute('aria-label') || '').trim()) continue;
+    const labelledBy = (fs.getAttribute('aria-labelledby') || '').split(/\\s+/).filter(Boolean);
+    if (labelledBy.some((id) => text(document.getElementById(id)))) continue;
+    structure.fieldsets.push({
+      selector: selectorOf(fs),
+      rect: rectOf(fs),
+      issue: legend ? 'empty legend' : 'no name',
+    });
   }
   const radiosByName = new Map();
   for (const r of document.querySelectorAll('input[type="radio"][name]')) {
@@ -41019,6 +41166,7 @@ var probe_default = `// Runs inside the audited page. Plain JavaScript (no impor
 `;
 
 // src/browser/keyboard.ts
+var DEV_OVERLAY = "nextjs-portal, vite-error-overlay, astro-dev-toolbar, #webpack-dev-server-client-overlay";
 var FOCUS_INFO = `(el) => {
   if (!el || el === document.body || el === document.documentElement) return null;
   const sx = window.scrollX, sy = window.scrollY;
@@ -41078,6 +41226,17 @@ var FOCUS_INFO = `(el) => {
     if (!hit || hit === el || el.contains(hit) || hit.contains(el)) { visiblePts++; continue; }
     if (isCover(hit)) cover = cover || hit;
   }
+  const noBox = (e) => { const b = e.getBoundingClientRect(); return b.width <= 1 || b.height <= 1; };
+  const rootHost = el.getRootNode && el.getRootNode().host;
+  // A stop with text or an accessible name is content a person can reach, so a hidden one is a real focus-visible
+  // failure (a clipped skip link that stays 1 x 1 while focused), not a stop without a box.
+  const labelledBy = (el.getAttribute('aria-labelledby') || '').split(/\\s+/).filter(Boolean)
+    .map((id) => { const n = document.getElementById(id); return n ? (n.textContent || '') : ''; }).join('').trim();
+  const hasName = !!((el.textContent || '').trim() || (el.getAttribute('aria-label') || '').trim() || labelledBy ||
+    (el.getAttribute('title') || '').trim() || (el.getAttribute('alt') || '').trim());
+  const boxless = !!(el.matches(${JSON.stringify(DEV_OVERLAY)}) || (rootHost && rootHost.matches(${JSON.stringify(DEV_OVERLAY)})) ||
+    (noBox(el) && !hasName && !Array.from(el.querySelectorAll('*')).some((d) => !noBox(d)) &&
+      !(el.shadowRoot && Array.from(el.shadowRoot.querySelectorAll('*')).some((d) => !noBox(d)))));
   const name = (el.getAttribute('aria-label') || el.innerText || el.value || el.getAttribute('title') || '').replace(/\\s+/g, ' ').trim().slice(0, 80);
   // The element's identity as markup (like an axe node's html), so a state rule (.tool[aria-pressed]) can be found.
   const attrs = ['id', 'class', 'role', 'aria-pressed', 'aria-expanded', 'aria-selected', 'aria-checked', 'aria-current', 'data-state']
@@ -41090,6 +41249,7 @@ var FOCUS_INFO = `(el) => {
     obscured: !selfHidden && inViewport > 0 && visiblePts === 0 && !!cover,
     coverSelector: cover ? sel(cover) : undefined,
     inModal: !!el.closest('[aria-modal="true"], dialog[open]'),
+    boxless,
   };
 }`;
 var FOCUS_STYLES = `(el) => {
@@ -41448,9 +41608,16 @@ function watchContext(browser, ctx) {
 }
 function networkLimitations(r) {
   const out = [];
-  if (r.blocked.length)
+  const list2 = (bs) => `${bs.slice(0, 3).map((b) => `${b.host}:${b.port}`).join(", ")}${bs.length > 3 ? ", \u2026" : ""}`;
+  const denied = r.blocked.filter((b) => b.reason.includes("--deny-local"));
+  const other = r.blocked.filter((b) => !b.reason.includes("--deny-local"));
+  if (denied.length)
+    out.push(
+      `The network guard refused ${denied.length} connection(s) to local addresses because --deny-local is set (${list2(denied)}); content that depends on them was not loaded.`
+    );
+  if (other.length)
     out.push(
-      `The network guard refused ${r.blocked.length} connection(s) to non-public addresses (${r.blocked.slice(0, 3).map((b) => `${b.host}:${b.port}`).join(", ")}${r.blocked.length > 3 ? ", \u2026" : ""}); content that depends on them was not loaded.`
+      `The network guard refused ${other.length} connection(s) to non-public addresses (${list2(other)}); content that depends on them was not loaded.`
     );
   if (r.escaped.length)
     out.push(
@@ -41635,7 +41802,11 @@ var STATE = `(controls, mode) => {
   if (mode === 'same') {
     const d = window.__jouriloDialog;
     const ae = document.activeElement;
-    return { dialogOpen: visible(d) && (d.tagName !== 'DIALOG' || d.open), unlabelled: false, focusInDialog: !!d && !!ae && d.contains(ae), focusables: 0, controlledVisible: null, activeSelector: ae && ae !== document.body ? (ae.id ? '#' + ae.id : ae.tagName.toLowerCase()) : null };
+    let deep = ae;
+    while (deep && deep.shadowRoot && deep.shadowRoot.activeElement) deep = deep.shadowRoot.activeElement;
+    // A focus guard (Base UI, Radix, React Aria, Headless UI) is an empty sentinel; focus parked there is not an escape.
+    const onSentinel = !!deep && deep !== document.body && !(deep.textContent || '').trim() && (deep.getAttribute('aria-hidden') === 'true' || deep.getAttributeNames().some((n) => /focus-?guard|focus-?trap|data-.*sentinel/i.test(n)));
+    return { dialogOpen: visible(d) && (d.tagName !== 'DIALOG' || d.open), unlabelled: false, focusInDialog: !!d && !!ae && d.contains(ae), onSentinel, focusables: 0, controlledVisible: null, activeSelector: ae && ae !== document.body ? (ae.id ? '#' + ae.id : ae.tagName.toLowerCase()) : null };
   }
   const dialogs = Array.from(document.querySelectorAll('[role="dialog"], [role="alertdialog"], dialog[open], [aria-modal="true"]')).filter(visible);
   let d = dialogs[dialogs.length - 1] || null;
@@ -41665,6 +41836,20 @@ var STATE = `(controls, mode) => {
     activeSelector: ae && ae !== document.body ? (ae.id ? '#' + ae.id : ae.tagName.toLowerCase()) : null,
   };
 }`;
+var WAIT_FOCUS_STABLE = `new Promise((resolve) => {
+  const deepActive = () => { let a = document.activeElement; while (a && a.shadowRoot && a.shadowRoot.activeElement) a = a.shadowRoot.activeElement; return a; };
+  const start = performance.now();
+  let last = deepActive();
+  let same = 0;
+  const tick = () => {
+    const now = deepActive();
+    same = now === last ? same + 1 : 0;
+    last = now;
+    if (same >= 4 || performance.now() - start >= 250) resolve(true);
+    else requestAnimationFrame(tick);
+  };
+  requestAnimationFrame(tick);
+})`;
 var COMPOSITES = `(() => {
   const ITEM = { tablist: 'tab', radiogroup: 'radio', listbox: 'option', menubar: 'menuitem, [role="menuitemcheckbox"], [role="menuitemradio"]', tree: 'treeitem' };
   const visible = (e) => e.getClientRects().length > 0 && getComputedStyle(e).visibility !== 'hidden';
@@ -41779,8 +41964,9 @@ async function checkWidgets(page) {
         );
       } else {
         for (let k = 0; k <= after.focusables; k++) await page.keyboard.press("Tab");
+        await page.evaluate(WAIT_FOCUS_STABLE).catch(() => void 0);
         const tabbed = await state(t.controls, "same");
-        if (tabbed.dialogOpen && !tabbed.focusInDialog)
+        if (tabbed.dialogOpen && !tabbed.focusInDialog && !tabbed.onSentinel)
           issue(
             "dialog-focus-escapes",
             `Pressing Tab ${after.focusables + 1} time(s) moved focus out of the open dialog to ${tabbed.activeSelector ?? "the page"}.`
@@ -41913,11 +42099,54 @@ async function settle(page, timeoutMs) {
   await page.waitForTimeout(300);
 }
 var AXE_TAGS = ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa", "best-practice"];
+var HIDDEN_SKIP_RULES = /* @__PURE__ */ new Set(["color-contrast", "color-contrast-enhanced"]);
 async function runAxe(page) {
   await page.addScriptTag({ content: import_axe_core.default.source });
   const raw = await page.evaluate(
     `axe.run(document, { runOnly: { type: 'tag', values: ${JSON.stringify(AXE_TAGS)} }, resultTypes: ['violations', 'incomplete'], elementRef: false, rules: { 'target-size': { enabled: true } } })`
   );
+  const hiddenFlags = await page.evaluate(
+    `(${String(
+      (groups) => groups.map((target) => {
+        try {
+          let root = document;
+          let el = null;
+          const chain = [];
+          for (let i = 0; i < target.length; i++) {
+            const part = target[i];
+            const hops = Array.isArray(part) ? part : [part];
+            for (let h = 0; h < hops.length; h++) {
+              el = root.querySelector(hops[h]);
+              if (!el) return false;
+              chain.push(el);
+              if (h < hops.length - 1) {
+                if (!el.shadowRoot) return false;
+                root = el.shadowRoot;
+              }
+            }
+            if (i < target.length - 1) {
+              const doc = el?.contentDocument;
+              if (!doc) return false;
+              root = doc;
+            }
+          }
+          return chain.some((c) => c.closest('[aria-hidden="true"]') !== null);
+        } catch {
+          return false;
+        }
+      })
+    )})(${JSON.stringify(
+      raw.incomplete.flatMap((r) => HIDDEN_SKIP_RULES.has(r.id) ? r.nodes.map((n) => n.target) : [])
+    )})`
+  ).catch(() => []);
+  {
+    let q = 0;
+    for (const r of raw.incomplete) {
+      if (!HIDDEN_SKIP_RULES.has(r.id)) continue;
+      r.nodes = r.nodes.filter(() => !hiddenFlags[q++]);
+    }
+    raw.incomplete = raw.incomplete.filter((r) => !HIDDEN_SKIP_RULES.has(r.id) || r.nodes.length > 0);
+  }
   const map = (r) => ({
     id: r.id,
     impact: r.impact ?? null,
@@ -41986,6 +42215,10 @@ async function applyThrottle(page) {
     return false;
   }
 }
+function captureScreenshotFiles(url, vp) {
+  const base2 = `${slug(new URL(url).pathname.replace(/^\/$/, "home"), 40)}-${shortHash(url).slice(0, 6)}-${vp.name}`;
+  return { full: join6("screenshots", `${base2}.jpg`), fold: join6("screenshots", `${base2}-fold.jpg`) };
+}
 async function capturePage(ctx, url, vp, opts) {
   const timeoutMs = opts.timeoutMs ?? 3e4;
   const page = await ctx.newPage();
@@ -42006,6 +42239,20 @@ async function capturePage(ctx, url, vp, opts) {
     keyboard: null,
     errors: []
   };
+  const redirects = [];
+  page.on("response", (res) => {
+    const status = res.status();
+    if (status < 300 || status >= 400 || redirects.length >= 10) return;
+    if (!res.request().isNavigationRequest() || res.request().frame() !== page.mainFrame()) return;
+    const location = res.headers().location;
+    if (!location) return;
+    let to = location;
+    try {
+      to = new URL(location, res.url()).href;
+    } catch {
+    }
+    redirects.push({ status, from: redactUrl(res.url()), to: redactUrl(to) });
+  });
   try {
     if (opts.throttle && !await applyThrottle(page))
       obs.errors.push("Throttling is only available in Chromium.");
@@ -42015,6 +42262,7 @@ async function capturePage(ctx, url, vp, opts) {
       response = await page.goto(url, { waitUntil: "load", timeout: timeoutMs });
     } catch (err) {
       obs.errors.push(`navigation: ${err.message.split("\n")[0]}`);
+      if (redirects.length) obs.redirects = redirects;
       return obs;
     }
     const signal = response?.headers()[GUARD_UPSTREAM_ERROR_HEADER];
@@ -42045,11 +42293,9 @@ async function capturePage(ctx, url, vp, opts) {
       });
     }
     if (opts.screenshots !== false) {
-      const base2 = `${slug(new URL(url).pathname.replace(/^\/$/, "home"), 40)}-${shortHash(url).slice(0, 6)}-${vp.name}`;
       const mask = [...DEFAULT_MASK, ...opts.mask ?? []].map((s) => page.locator(s));
       const mode = opts.evidence ?? "full";
-      const full = join6("screenshots", `${base2}.jpg`);
-      const fold = join6("screenshots", `${base2}-fold.jpg`);
+      const { full, fold } = captureScreenshotFiles(url, vp);
       try {
         const height = Math.min(obs.probe?.scroll.height ?? vp.height, FULL_PAGE_MAX_HEIGHT[mode]);
         if (mode === "minimal" && height <= vp.height) {
@@ -42181,12 +42427,21 @@ function pathOf2(url) {
     return url;
   }
 }
+function fingerprintPath(url) {
+  try {
+    const u = new URL(url);
+    const path2 = u.pathname === "/" ? "/" : u.pathname.replace(/\/+$/, "") || "/";
+    return `${path2}${u.search}`;
+  } catch {
+    return url;
+  }
+}
 function makeFinding(input) {
   const { key, occurrences, reproduction, ...rest } = input;
   const finding2 = {
     ...rest,
     // Viewport is deliberately not part of the fingerprint: the same defect seen at two widths is one finding.
-    fingerprint: shortHash(input.ruleId, pathOf2(input.url), key ?? "", input.journey ?? ""),
+    fingerprint: shortHash(input.ruleId, fingerprintPath(input.url), key ?? "", input.journey ?? ""),
     occurrences: occurrences ?? 1,
     reproduction: reproduction ?? defaultReproduction(input)
   };
@@ -42202,6 +42457,11 @@ var SEVERITY_ORDER = ["critical", "serious", "moderate", "minor", "info"];
 function severityRank(s) {
   return SEVERITY_ORDER.indexOf(s);
 }
+var KIND_STRENGTH = { "needs-review": 0, hypothesis: 1, defect: 2 };
+var CONFIDENCE_STRENGTH = { low: 0, medium: 1, high: 2 };
+function strength(f) {
+  return KIND_STRENGTH[f.kind] * 10 + CONFIDENCE_STRENGTH[f.confidence];
+}
 function mergeFindings(findings) {
   const byFp = /* @__PURE__ */ new Map();
   for (const f of findings) {
@@ -42214,6 +42474,13 @@ function mergeFindings(findings) {
     viewports.delete("");
     prev.viewport = [...viewports].join(", ");
     if (severityRank(f.severity) < severityRank(prev.severity)) prev.severity = f.severity;
+    if (strength(f) > strength(prev)) {
+      prev.kind = f.kind;
+      prev.confidence = f.confidence;
+      prev.title = f.title;
+      prev.description = f.description;
+      prev.recommendation = f.recommendation;
+    }
     prev.occurrences = Math.max(prev.occurrences, f.occurrences);
     for (const e of f.evidence) {
       if (prev.evidence.length >= 12) break;
@@ -42748,6 +43015,20 @@ async function loadRobots(origin, policy, timeoutMs = 8e3) {
   const text = await fetchText(`${origin}/robots.txt`, timeoutMs, policy);
   return text === null ? null : parseRobots(text, USER_AGENT_TOKEN);
 }
+function robotsOverrideLimitation(url) {
+  return `robots.txt disallows ${url}; it was audited because it was requested explicitly.`;
+}
+async function explicitRobotsOverrides(urls, policy, timeoutMs = 8e3) {
+  const out = [];
+  const rules = /* @__PURE__ */ new Map();
+  for (const raw of urls) {
+    const u = new URL(raw);
+    if (!rules.has(u.origin)) rules.set(u.origin, await loadRobots(u.origin, policy, timeoutMs));
+    const r = rules.get(u.origin);
+    if (r && !isAllowed(r, `${u.pathname}${u.search}`)) out.push(redactUrl(u.toString()));
+  }
+  return out;
+}
 async function sitemapUrls(origin, robots, timeoutMs, policy) {
   const local = policy.target === "local";
   const rebase = (raw) => {
@@ -42783,27 +43064,34 @@ async function crawl(ctx, start, opts) {
   const origin = new URL(start).origin;
   const robots = opts.respectRobots ? await loadRobots(origin, opts.policy) : null;
   const skipped = [];
+  const robotsOverridden = [];
   const seen = /* @__PURE__ */ new Map();
   const queue = [];
-  const push = (raw, depth) => {
+  const push = (raw, depth, explicit = false) => {
     let n;
+    let key;
     try {
       n = normalizeForCrawl(raw);
+      key = crawlKey(raw);
     } catch {
       return;
     }
-    if (seen.has(n) || !isCrawlable(n, origin)) return;
+    if (seen.has(key) || !isCrawlable(n, origin)) return;
     const u = new URL(n);
     if (robots && !isAllowed(robots, `${u.pathname}${u.search}`)) {
-      skipped.push({ url: redactUrl(n), reason: "robots.txt" });
-      seen.set(n, depth);
-      return;
+      if (explicit) {
+        robotsOverridden.push(redactUrl(n));
+      } else {
+        skipped.push({ url: redactUrl(n), reason: "robots.txt" });
+        seen.set(key, { url: n, depth, blocked: true });
+        return;
+      }
     }
-    seen.set(n, depth);
+    seen.set(key, { url: n, depth, blocked: false });
     queue.push({ url: n, depth });
   };
-  push(start, 0);
-  for (const extra of opts.include ?? []) push(new URL(extra, start).toString(), 0);
+  push(start, 0, true);
+  for (const extra of opts.include ?? []) push(new URL(extra, start).toString(), 0, true);
   const fromSitemap = await sitemapUrls(origin, robots, opts.timeoutMs, opts.policy);
   for (const u of fromSitemap.urls) push(u, 1);
   const visited = /* @__PURE__ */ new Set();
@@ -42832,7 +43120,7 @@ async function crawl(ctx, start, opts) {
   } finally {
     await page.close().catch(() => void 0);
   }
-  const ranked = [...seen.entries()].filter(([u]) => !skipped.some((s) => s.url === redactUrl(u) && s.reason === "robots.txt")).map(([url, depth]) => ({ url, depth, role: pageRole(url), score: rankUrl(url, depth) })).sort((a, b) => b.score - a.score);
+  const ranked = [...seen.values()].filter((e) => !e.blocked).map(({ url, depth }) => ({ url, depth, role: pageRole(url), score: rankUrl(url, depth) })).sort((a, b) => b.score - a.score);
   const picked = [];
   const roles = /* @__PURE__ */ new Set();
   for (const p of ranked) {
@@ -42846,9 +43134,11 @@ async function crawl(ctx, start, opts) {
     if (picked.length >= opts.maxPages) break;
     if (!picked.includes(p)) picked.push(p);
   }
+  const auditedOverrides = robotsOverridden.filter((u) => picked.some((p) => redactUrl(p.url) === u));
   return {
     pages: picked,
     skipped,
+    robotsOverridden: auditedOverrides,
     robots,
     sitemapUrls: fromSitemap.urls.length,
     sitemapRebasedFrom: fromSitemap.rebasedFrom
@@ -43120,6 +43410,9 @@ var AFTER = `([sel, beforeText]) => {
   const focusOnProblem = !!ae && ae !== document.body && (fields.includes(ae) || /error|alert/i.test((ae.getAttribute('role') || '') + ' ' + (ae.className || '') + ' ' + (ae.id || '')));
   return { errorish, freshCount: fresh.length, ariaInvalid, described, live, focusOnProblem, fieldCount: fields.length };
 }`;
+function formScreenshotFile(url, selector, vp) {
+  return toPosix(`screenshots/form-${shortHash(url, selector).slice(0, 8)}-${vp.name}.jpg`);
+}
 async function probeFormValidation(ctx, url, form, vp, policy, runDir) {
   const page = await ctx.newPage();
   const guard = await installRequestGuard(page, {
@@ -43166,7 +43459,7 @@ async function probeFormValidation(ctx, url, form, vp, policy, runDir) {
     await page.waitForLoadState("networkidle", { timeout: 3e3 }).catch(() => void 0);
     await page.waitForTimeout(600);
     const intercepted = guard.since(submittedAt);
-    const shotFile = toPosix(`screenshots/form-${shortHash(url, form.selector).slice(0, 8)}-${vp.name}.jpg`);
+    const shotFile = formScreenshotFile(url, form.selector, vp);
     await page.screenshot({
       path: `${runDir}/${shotFile}`,
       type: "jpeg",
@@ -43689,7 +43982,10 @@ async function runJourney(browser, spec, opts) {
   const startUrl = new URL(interpolate(spec.start, opts.data), opts.base);
   const allSteps = [{ action: "goto", url: startUrl.toString() }, ...spec.steps];
   const shot = async (i) => {
-    const file2 = join9("screenshots", `journey-${spec.id}-${vp.name}-${String(i).padStart(2, "0")}.jpg`);
+    const file2 = join9(
+      "screenshots",
+      `journey-${spec.id}-${vp.name}${opts.attempt === void 0 ? "" : `-a${opts.attempt}`}-${String(i).padStart(2, "0")}.jpg`
+    );
     try {
       await page.screenshot({
         path: join9(opts.runDir, file2),
@@ -44080,7 +44376,8 @@ function keyboardFindings(obs) {
   const out = [];
   const vp = obs.viewport.name;
   const shot = obs.screenshot ? { file: obs.screenshot } : {};
-  const invisible = kb.stops.filter((s) => s.indicatorChecked && s.indicatorChanges.length === 0);
+  const boxed = kb.stops.filter((s) => !s.boxless);
+  const invisible = boxed.filter((s) => s.indicatorChecked && s.indicatorChanges.length === 0);
   if (invisible.length) {
     out.push(
       makeFinding({
@@ -44093,7 +44390,7 @@ function keyboardFindings(obs) {
         provenance: "measured",
         url: obs.url,
         viewport: vp,
-        description: `${invisible.length} of ${kb.stops.length} elements reached with Tab look exactly the same focused and unfocused (outline, box-shadow, border, background, color, underline and the parent's styles were compared).`,
+        description: `${invisible.length} of ${boxed.length} elements reached with Tab look exactly the same focused and unfocused (outline, box-shadow, border, background, color, underline and the parent's styles were compared).`,
         impact: "Keyboard users cannot see where they are on the page, so they cannot operate it reliably.",
         recommendation: "Do not remove the focus outline without a replacement. Add a clearly visible :focus-visible style (e.g. a 2 px outline with 3:1 contrast) to the shared button/link/input components.",
         standards: [wcag("2.4.7")],
@@ -44487,9 +44784,9 @@ function structureFindings(obs) {
         provenance: "measured",
         url: obs.url,
         viewport: vp,
-        description: `${st.fieldsets.length} fieldset(s) have no legend or an empty one, so the group of fields has no name.`,
+        description: `${st.fieldsets.length} fieldset(s) have no legend, aria-label or aria-labelledby (or an empty one), so the group of fields has no name.`,
         impact: 'Screen-reader users hear the fields without the question they answer (e.g. "Yes / No" without "Do you have a passport?").',
-        recommendation: "Give every fieldset a first-child <legend> with the group question; remove fieldsets used only for styling.",
+        recommendation: "Give every fieldset a first-child <legend> with the group question (or an aria-label / aria-labelledby that names it); remove fieldsets used only for styling.",
         standards: [wcag("1.3.1"), wcag("3.3.2")],
         evidence: ev(st.fieldsets, (i) => st.fieldsets[i].issue),
         occurrences: st.fieldsets.length
@@ -44568,28 +44865,35 @@ function responsiveFindings(obs) {
   if (p.overflow.docWidth > p.overflow.viewportWidth + 1) {
     const narrow = vp.width <= 400;
     const extra = p.overflow.docWidth - p.overflow.viewportWidth;
+    const located = p.overflow.offenders.length > 0;
     out.push(
       makeFinding({
         ruleId: "jourilo/horizontal-overflow",
         title: `Page scrolls sideways at ${vp.width} px`,
         category: "responsive",
-        kind: "defect",
+        kind: located ? "defect" : "needs-review",
         severity: narrow ? "serious" : "moderate",
-        confidence: "high",
+        confidence: located ? "high" : "low",
         provenance: "measured",
         url: obs.url,
         viewport: vp.name,
-        description: `The document is ${p.overflow.docWidth} px wide in a ${p.overflow.viewportWidth} px viewport (${extra} px of horizontal scrolling).${p.overflow.offenders.length ? ` Widest culprit: <${p.overflow.offenders[0].tag}> ending at ${p.overflow.offenders[0].right} px.` : ""}`,
+        description: `The document is ${p.overflow.docWidth} px wide in a ${p.overflow.viewportWidth} px viewport (${extra} px of horizontal scrolling).${located ? ` Widest culprit: <${p.overflow.offenders[0].tag}> ending at ${p.overflow.offenders[0].right} px.` : " The measurement is real, but no element could be located that sticks out; check the page by hand (for example scripted or transformed content)."}`,
         impact: "Content is cut off or requires two-dimensional scrolling; on phones the page wobbles sideways while scrolling.",
         recommendation: "Constrain the offending element (max-width: 100%, flex-wrap, min-width: 0 on flex children, overflow-wrap: anywhere for long strings, responsive tables in a scroll container).",
         standards: vp.width <= 320 ? [wcag("1.4.10")] : [wcag("1.4.10"), nielsen(8)],
-        evidence: p.overflow.offenders.map((o) => ({
+        evidence: located ? p.overflow.offenders.map((o) => ({
           type: "element",
           selector: o.selector,
           rect: o.rect,
           data: { right: o.right, width: o.width, viewport: p.overflow.viewportWidth },
           ...shot
-        })),
+        })) : [
+          {
+            type: obs.screenshot ? "screenshot" : "metric",
+            data: { docWidth: p.overflow.docWidth, viewport: p.overflow.viewportWidth },
+            ...shot
+          }
+        ],
         occurrences: Math.max(1, p.overflow.offenders.length)
       })
     );
@@ -44650,12 +44954,26 @@ function responsiveFindings(obs) {
 function reliabilityFindings(obs) {
   const out = [];
   const vp = obs.viewport.name;
-  const navError = obs.errors.find((e) => e.startsWith("navigation:"));
+  const rawNavError = obs.errors.find((e) => e.startsWith("navigation:"));
+  const navError = rawNavError === void 0 ? void 0 : redactText(rawNavError);
   if (navError) {
+    const hops = obs.redirects ?? [];
+    const froms = hops.map((h) => h.from);
+    const loop = /ERR_TOO_MANY_REDIRECTS/i.test(navError) || new Set(froms).size < froms.length;
+    const short = (u) => {
+      try {
+        const a = new URL(redactUrl(u));
+        return a.origin === new URL(obs.url).origin ? `${a.pathname}${a.search}` : a.toString();
+      } catch {
+        return redactText(u);
+      }
+    };
+    const chain = hops.slice(0, 5).map((h) => `${h.status} ${short(h.from)} \u2192 ${short(h.to)}`);
+    const chainText = chain.join(", ") + (hops.length > chain.length ? `, and ${hops.length - chain.length} more` : "");
     out.push(
       makeFinding({
         ruleId: "jourilo/page-unreachable",
-        title: "Page failed to load",
+        title: loop ? "Page redirects to itself in a loop" : "Page failed to load",
         category: "reliability",
         kind: "defect",
         severity: "critical",
@@ -44663,11 +44981,14 @@ function reliabilityFindings(obs) {
         provenance: "observed",
         url: obs.url,
         viewport: vp,
-        description: navError,
+        description: loop ? `The browser followed a redirect loop and gave up (${navError})${chainText ? `. Redirects seen: ${chainText}` : ""}.` : navError,
         impact: "Visitors cannot use this page at all.",
-        recommendation: "Check the server, DNS and redirects for this URL.",
+        recommendation: loop ? "Fix the server's redirect rules or host configuration (HTTP/HTTPS, www and trailing-slash redirects, or a proxy or CDN redirect) so the URL stops redirecting back to itself." : "Check the server, DNS and redirects for this URL.",
         standards: [],
-        evidence: [{ type: "network", snippet: navError }]
+        evidence: [
+          { type: "network", snippet: navError },
+          ...chain.length ? [{ type: "network", snippet: chain.join("\n") }] : []
+        ]
       })
     );
     return out;
@@ -44879,6 +45200,8 @@ var PAGE_RULES = {
 };
 var AuditStopped = class extends Error {
 };
+var NameUnresolved = class extends Error {
+};
 function untilStopped(p, signal) {
   if (!signal) return p;
   p.catch(() => void 0);
@@ -44889,6 +45212,43 @@ function untilStopped(p, signal) {
     p.then(resolve10, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
+var STOP_GRACE_MS = 3e3;
+var ABANDONED = /* @__PURE__ */ Symbol("abandoned");
+async function withinGrace(work, signal, abandon) {
+  if (!signal) return work;
+  work.catch(() => void 0);
+  let timer;
+  let onAbort = () => void 0;
+  const expired = new Promise((resolve10) => {
+    onAbort = () => {
+      timer = setTimeout(() => resolve10(ABANDONED), STOP_GRACE_MS);
+    };
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    const first = await Promise.race([work, expired]);
+    if (first !== ABANDONED) return first;
+  } finally {
+    clearTimeout(timer);
+    signal.removeEventListener("abort", onAbort);
+  }
+  await abandon().catch(() => void 0);
+  throw new AuditStopped();
+}
+async function settled(work, ms) {
+  let timer;
+  await Promise.race([
+    work.then(
+      () => void 0,
+      () => void 0
+    ),
+    new Promise((r) => {
+      timer = setTimeout(r, ms);
+    })
+  ]);
+  clearTimeout(timer);
+}
 function stopLimitation(stoppedBy, urls, viewports, captured) {
   const by = stoppedBy === "signal" ? "by a stop signal" : "when the --max-duration budget ran out";
   if (!urls) return `The run was stopped early ${by}, before pages were discovered, so no page was audited.`;
@@ -44910,15 +45270,27 @@ function resolveRunId(ws, requested) {
       `Invalid run id "${requested}".`,
       'Use 1-64 letters, digits, "_" or "-", starting with a letter or digit.'
     );
-  if (existsSync6(join10(ws.runDir(requested), "run.json")))
+  const dir = ws.runDir(requested);
+  if (existsSync6(join10(dir, "run.json")))
     throw new JouriloError("INVALID_INPUT", `Run ${requested} already exists.`, "Pick another --run-id.");
+  if (existsSync6(dir))
+    throw new JouriloError(
+      "INVALID_INPUT",
+      `The directory of run ${requested} already exists (${dir}) without a finished run, probably left by a run that did not finish.`,
+      "Pick another --run-id, or remove that directory first."
+    );
   return requested;
 }
 async function runAudit(ws, opts) {
   const id = resolveRunId(ws, opts.runId);
   const dismissals = loadDismissals(ws);
   const target = parseTargetUrl(opts.target);
-  const hostClass = await checkTarget(target, { allowPrivate: opts.allowPrivate });
+  const check = await checkTargetDetailed(target, {
+    allowPrivate: opts.allowPrivate,
+    // The target of a served directory is Jourilo's own server; the guard still confines the page.
+    ...opts.denyLocal && opts.servedPort === void 0 ? { denyLocal: true } : {}
+  });
+  const hostClass = check.hostClass;
   const log = opts.onProgress ?? (() => void 0);
   const runDir = ws.createRunDir(id);
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -44929,7 +45301,7 @@ async function runAudit(ws, opts) {
   };
   let urls;
   if (opts.urls?.length) {
-    urls = opts.urls.map((u) => ({ url: new URL(u, target).toString() }));
+    urls = [...new Set(opts.urls.map((u) => new URL(u, target).toString()))].map((url) => ({ url }));
     for (const u of urls) {
       if (new URL(u.url).origin !== target.origin)
         throw new JouriloError("UNSAFE_URL", `--url ${u.url} is not on the target origin ${target.origin}.`);
@@ -44950,18 +45322,26 @@ async function runAudit(ws, opts) {
   let network = { blocked: [], escaped: [] };
   const endBrowsing = async () => {
     if (session) network = session.report();
-    await session?.close();
+    const closing = session;
     session = void 0;
-    rmSync2(setupState, { force: true });
+    await closeBrowsing(closing, setupState);
   };
   try {
     try {
+      if (check.unresolved) throw new NameUnresolved();
       log(`Starting ${opts.browser} \u2026`);
       halt();
       session = await openGuardedBrowser(
         opts.browser,
         opts.headed,
-        { target: hostClass, allowPrivate: opts.allowPrivate },
+        {
+          target: hostClass,
+          allowPrivate: opts.allowPrivate,
+          ...opts.denyLocal ? {
+            denyLocal: true,
+            ...opts.servedPort === void 0 ? {} : { allowLoopbackPorts: [opts.servedPort] }
+          } : {}
+        },
         signal !== void 0
       );
       const browser = session.browser;
@@ -45026,6 +45406,7 @@ async function runAudit(ws, opts) {
         const robotsSkips = found.skipped.filter((s) => s.reason === "robots.txt").length;
         if (robotsSkips)
           limitations.push(`${robotsSkips} URL(s) were skipped because robots.txt disallows them.`);
+        for (const u of found.robotsOverridden) limitations.push(robotsOverrideLimitation(u));
         if (found.sitemapRebasedFrom)
           limitations.push(
             `The sitemap lists ${found.sitemapRebasedFrom} URLs; their paths were audited on the local server instead.`
@@ -45033,6 +45414,16 @@ async function runAudit(ws, opts) {
         if (!found.robots && opts.respectRobots && hostClass === "public")
           limitations.push("No robots.txt was found; crawling stayed on the target origin.");
         urls = discovered.length ? discovered : [{ url: target.toString() }];
+      } else if (opts.respectRobots) {
+        halt();
+        for (const u of await untilStopped(
+          explicitRobotsOverrides(
+            urls.map((x) => x.url),
+            session.guard.policy
+          ),
+          signal
+        ))
+          limitations.push(robotsOverrideLimitation(u));
       }
       log(
         `Auditing ${urls.length} page(s) \xD7 ${opts.viewports.length} viewport(s) in ${opts.browser} ${browserVersion}`
@@ -45049,7 +45440,7 @@ async function runAudit(ws, opts) {
           for (const { url } of urls) {
             halt();
             log(`  ${vp.name.padEnd(8)} ${redactUrl(url)}`);
-            const obs = await capturePage(ctx, url, vp, {
+            const capture = capturePage(ctx, url, vp, {
               runDir,
               guardToken: session.guard.token,
               timeoutMs: opts.timeoutMs,
@@ -45060,6 +45451,12 @@ async function runAudit(ws, opts) {
               throttle: opts.throttle,
               ...opts.evidence ? { evidence: opts.evidence } : {}
             });
+            const obs = await withinGrace(capture, signal, async () => {
+              await ctx.close();
+              await settled(capture, 1e3);
+              const { full, fold } = captureScreenshotFiles(url, vp);
+              for (const f of [full, fold]) rmSync2(join10(runDir, f), { force: true });
+            });
             observations.push(obs);
           }
         } finally {
@@ -45073,13 +45470,17 @@ async function runAudit(ws, opts) {
           for (let k = 1; k < runs2; k++) {
             halt();
             log(`  metrics  ${obs.viewport.name.padEnd(8)} ${obs.url} (run ${k + 1}/${runs2})`);
-            const v = await measureVitals(browser, obs.finalUrl, obs.viewport, {
-              runDir,
-              timeoutMs: opts.timeoutMs,
-              throttle: opts.throttle,
-              ...storageState ? { storageState } : {},
-              ...stateOptions(opts)
-            });
+            const v = await withinGrace(
+              measureVitals(browser, obs.finalUrl, obs.viewport, {
+                runDir,
+                timeoutMs: opts.timeoutMs,
+                throttle: opts.throttle,
+                ...storageState ? { storageState } : {},
+                ...stateOptions(opts)
+              }),
+              signal,
+              async () => void 0
+            );
             if (v) samples.push(v);
           }
           const m = medianVitals(samples);
@@ -45106,7 +45507,7 @@ async function runAudit(ws, opts) {
             for (const form of probeable.slice(0, 3)) {
               halt();
               log(`  form     ${o.url} ${form.selector}`);
-              const r = await probeFormValidation(
+              const probe = probeFormValidation(
                 ctx,
                 o.finalUrl,
                 form,
@@ -45114,6 +45515,11 @@ async function runAudit(ws, opts) {
                 { hostClass, allowSubmit: opts.allowSubmit ?? false, allowDestructive: false },
                 runDir
               );
+              const r = await withinGrace(probe, signal, async () => {
+                await ctx.close();
+                await settled(probe, 1e3);
+                rmSync2(join10(runDir, formScreenshotFile(o.finalUrl, form.selector, vp)), { force: true });
+              });
               formFindings.push(...r.findings);
               if (r.result.outcome === "blocked")
                 limitations.push(`Form ${form.selector} on ${o.url} was not submitted: ${r.result.detail}`);
@@ -45133,9 +45539,14 @@ async function runAudit(ws, opts) {
         );
       }
     } catch (err) {
-      if (!(err instanceof AuditStopped)) throw err;
-      stoppedBy = signal?.reason === "max-duration" ? "max-duration" : "signal";
-      log(`Stopped early (${stoppedBy}); writing a partial run \u2026`);
+      if (err instanceof NameUnresolved) {
+        const msg = `No page was loaded: the host name ${target.hostname} could not be resolved (no hosts entry or local DNS answer).`;
+        log(msg);
+        limitations.push(msg);
+      } else if (err instanceof AuditStopped) {
+        stoppedBy = signal?.reason === "max-duration" ? "max-duration" : "signal";
+        log(`Stopped early (${stoppedBy}); writing a partial run \u2026`);
+      } else throw err;
     }
     await endBrowsing();
     if (stoppedBy)
@@ -45201,6 +45612,7 @@ async function runAudit(ws, opts) {
       title: o.title,
       viewport: o.viewport.name,
       ...o.screenshot ? { screenshot: o.screenshot } : {},
+      ...o.foldScreenshot ? { foldScreenshot: o.foldScreenshot } : {},
       loadMs: o.loadMs,
       metrics: o.vitals ? toMetrics(o.vitals, o.vitalsSpread, o.vitalsRuns) : [],
       consoleErrors: o.console.filter((c) => c.type !== "warning").length,
@@ -45261,6 +45673,13 @@ async function runAudit(ws, opts) {
     await endBrowsing();
   }
 }
+async function closeBrowsing(session, setupState) {
+  try {
+    await session?.close();
+  } finally {
+    rmSync2(setupState, { force: true });
+  }
+}
 function summarize(findings, pages, journeys2) {
   const sev = { critical: 0, serious: 0, moderate: 0, minor: 0, info: 0 };
   const kind = { defect: 0, hypothesis: 0, "needs-review": 0 };
@@ -45340,6 +45759,12 @@ function stablePort(root) {
   for (const ch of resolve4(root)) h = h * 31 + ch.charCodeAt(0) >>> 0;
   return 41e3 + h % 8e3;
 }
+function isDirectoryTarget(arg) {
+  return !/^[a-z][a-z0-9+.-]*:\/\//i.test(arg) && existsSync7(arg) && statSync2(arg).isDirectory();
+}
+function servedPort(server) {
+  return Number(new URL(server.url).port);
+}
 async function serveStatic(root, port = 0, opts = {}) {
   if (!existsSync7(root) || !statSync2(root).isDirectory())
     throw new JouriloError("NOT_FOUND", `Not a directory: ${root}`);
@@ -48646,19 +49071,20 @@ async function suggest(ctx) {
   if (!target || ctx.ws.listRuns().some((r) => r.id === target) || target === "latest") {
     run = ctx.ws.loadRun(target ?? "latest").run;
   } else {
-    const isDir = existsSync11(target) && !target.includes("://");
+    const isDir = isDirectoryTarget(target);
     const server = isDir ? await serveStatic(resolve5(target)) : void 0;
     try {
       ctx.log("Discovering pages to derive journeys (no audit rules applied) \u2026");
       run = (await runAudit(ctx.ws, {
         target: server?.url ?? target,
         viewports: parseViewports("desktop"),
-        maxPages: num(ctx, "pages", 8),
+        maxPages: pagesOption(ctx, 8),
         maxDepth: 3,
         browser: "chromium",
         headed: false,
         respectRobots: true,
         allowPrivate: flag(ctx, "allow-private"),
+        ...denyLocalFrom(ctx) ? { denyLocal: true, ...server ? { servedPort: servedPort(server) } : {} } : {},
         keyboard: false,
         throttle: false,
         timeoutMs: 3e4,
@@ -48748,17 +49174,23 @@ async function runCmd(ctx) {
     );
   const state = parseStateOptions(ctx);
   const evidence = parseEvidence(ctx);
-  const isDir = existsSync11(baseArg) && !baseArg.includes("://");
+  const isDir = isDirectoryTarget(baseArg);
   const server = isDir ? await serveStatic(resolve5(baseArg)) : void 0;
   try {
     const base2 = parseTargetUrl(server?.url ?? baseArg);
-    const hostClass = await checkTarget(base2, { allowPrivate: flag(ctx, "allow-private") });
+    const denyLocal = denyLocalFrom(ctx);
+    refuseDenyLocalWebkit(denyLocal, str(ctx, "browser") ?? "chromium");
+    const hostClass = await checkTarget(base2, {
+      allowPrivate: flag(ctx, "allow-private"),
+      denyLocal: denyLocal && !server
+    });
     const id = newRunId();
     const runDir = ctx.ws.createRunDir(id);
     const browserName = str(ctx, "browser") ?? "chromium";
     const session = await openGuardedBrowser(browserName, flag(ctx, "headed"), {
       target: hostClass,
-      allowPrivate: flag(ctx, "allow-private")
+      allowPrivate: flag(ctx, "allow-private"),
+      ...denyLocal ? { denyLocal: true, ...server ? { allowLoopbackPorts: [servedPort(server)] } : {} } : {}
     });
     const browser = session.browser;
     const browserVersion = browser.version();
@@ -48826,6 +49258,7 @@ async function runCmd(ctx) {
               ...str(ctx, "auth") ? { storageState: str(ctx, "auth") } : {},
               ...state,
               ...evidence ? { evidence } : {},
+              ...repeat > 1 ? { attempt: k + 1 } : {},
               ...saveAuth ? { saveAuth } : {},
               ...allowOrigins.length ? { allowOrigins } : {},
               log: k === 0 ? ctx.log : void 0
@@ -48918,6 +49351,7 @@ var journeys = {
     "allow-submit": { type: "boolean" },
     "allow-destructive": { type: "boolean" },
     "allow-private": { type: "boolean" },
+    "deny-local": { type: "boolean" },
     "allow-origin": { type: "string", multiple: true },
     "fail-on-failure": { type: "boolean" },
     browser: { type: "string" },
@@ -48943,6 +49377,8 @@ Suggest options:
   --pages N              Pages to read when deriving journeys from a site (default 8)
   --force                Overwrite journey files that already exist (by default existing files are kept)
   --allow-private        Allow private-network hosts (10.x, 192.168.x, ...)
+  --deny-local           Refuse local targets (localhost, 127.0.0.1, [::1], *.localhost, *.test) (exit 3); a redirect or request to one is blocked by the network guard and listed in the limitations;
+                         JOURILO_DENY_LOCAL=1 does the same
 
 Run options:
   --base URL|DIR         The site or static build to run against (required)
@@ -48963,6 +49399,8 @@ Run options:
   --evidence MODE        full (default) or minimal: keep only the screenshots of the failed step, the step before it and the last step
   --repeat N             Run each journey N times (max 10); mixed outcomes are reported as flaky
   --allow-private        Allow private-network hosts (10.x, 192.168.x, ...)
+  --deny-local           Refuse local targets (localhost, 127.0.0.1, [::1], *.localhost, *.test) (exit 3); a redirect or request to one is blocked by the network guard and listed in the limitations;
+                         JOURILO_DENY_LOCAL=1 does the same. Not available with --browser webkit (exit 3)
   --fail-on-failure      Exit 1 when a journey fails
 
 Safety: payment, purchase, delete and cancel actions are never performed on non-local hosts; form submission
@@ -48999,6 +49437,7 @@ var AUDIT_OPTIONS = {
   throttle: { type: "boolean" },
   "ignore-robots": { type: "boolean" },
   "allow-private": { type: "boolean" },
+  "deny-local": { type: "boolean" },
   mask: { type: "string", multiple: true },
   auth: { type: "string" },
   locale: { type: "string" },
@@ -49019,20 +49458,35 @@ var AUDIT_OPTIONS = {
 };
 var SEVERITIES = ["critical", "serious", "moderate", "minor"];
 var BROWSERS = ["chromium", "firefox", "webkit", "chrome", "msedge"];
+function stoppedTwiceLine(json) {
+  const message = "A second stop signal: quitting at once (exit 130). No run was written for this audit.";
+  return json ? `${JSON.stringify({ type: "error", error: { code: "STOPPED_TWICE", message } })}
+` : `jourilo: ${message}
+`;
+}
 function stopController(ctx, maxDurationS) {
   const controller = new AbortController();
+  const grace = `${STOP_GRACE_MS / 1e3} s`;
   let signals = 0;
   const onSignal = () => {
-    if (++signals > 1) process.exit(130);
+    if (++signals > 1) {
+      try {
+        writeSync2(2, stoppedTwiceLine(ctx.json));
+      } catch {
+      }
+      process.exit(130);
+    }
     ctx.log(
-      "Stopping: the current page finishes, then a partial run is written (signal again to quit now) \u2026"
+      `Stopping: the page in progress gets up to ${grace} to finish, then a partial run is written (signal again to quit now) \u2026`
     );
     controller.abort("signal");
   };
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
   const timer = maxDurationS ? setTimeout(() => {
-    ctx.log(`--max-duration ${maxDurationS}s reached: stopping after the current page \u2026`);
+    ctx.log(
+      `--max-duration ${maxDurationS}s reached: the page in progress gets up to ${grace} to finish, then a partial run is written \u2026`
+    );
     controller.abort("max-duration");
   }, maxDurationS * 1e3) : void 0;
   return {
@@ -49049,32 +49503,34 @@ async function auditCommand(ctx, usage2, categories) {
   const browser = str(ctx, "browser") ?? "chromium";
   if (!BROWSERS.includes(browser))
     throw new JouriloError("USAGE", `--browser must be one of ${BROWSERS.join(", ")}.`);
+  refuseDenyLocalWebkit(denyLocalFrom(ctx), browser);
   const failOn = str(ctx, "fail-on");
   if (failOn && !SEVERITIES.includes(failOn))
     throw new JouriloError("USAGE", `--fail-on must be one of ${SEVERITIES.join(", ")}.`);
   const state = parseStateOptions(ctx);
   const auth = str(ctx, "auth");
   if (auth && !existsSync12(auth)) throw new JouriloError("NOT_FOUND", `Auth state file not found: ${auth}`);
-  const maxDuration = str(ctx, "max-duration") === void 0 ? void 0 : num(ctx, "max-duration", 0);
-  if (maxDuration === 0) throw new JouriloError("USAGE", "--max-duration must be more than 0 seconds.");
+  const maxDuration = maxDurationOption(ctx);
+  const maxPages = pagesOption(ctx, 6);
   const evidence = parseEvidence(ctx);
   const setupRef = str(ctx, "setup-journey");
   const setupJourney = setupRef ? loadJourneys(ctx.ws, [setupRef])[0] : void 0;
   const stop = stopController(ctx, maxDuration);
   let server;
   try {
-    const isDir = !/^[a-z]+:\/\//i.test(targetArg) && existsSync12(targetArg) && statSync5(targetArg).isDirectory();
+    const isDir = isDirectoryTarget(targetArg);
     server = isDir ? await serveStatic(resolve6(targetArg)) : void 0;
     const repo = str(ctx, "repo") ?? (isDir ? resolve6(targetArg) : void 0);
     const opts = {
       target: server ? server.url : targetArg,
       viewports: parseViewports(str(ctx, "viewports")),
-      maxPages: num(ctx, "pages", 6),
+      maxPages,
       maxDepth: num(ctx, "depth", 3),
       browser,
       headed: flag(ctx, "headed"),
       respectRobots: !flag(ctx, "ignore-robots"),
       allowPrivate: flag(ctx, "allow-private"),
+      ...denyLocalFrom(ctx) ? { denyLocal: true, ...server ? { servedPort: servedPort(server) } : {} } : {},
       keyboard: !flag(ctx, "no-keyboard"),
       throttle: flag(ctx, "throttle"),
       runs: num(ctx, "runs", 1),
@@ -49174,7 +49630,8 @@ function partialLines(run) {
 function noPageLines(run) {
   if (run.outcome !== "no-page-loaded") return [];
   const first = run.findings.find((f) => f.ruleId === "jourilo/page-unreachable");
-  return [`No page could be loaded from ${run.target}.`, ...first ? [`  ${first.description}`] : [], ""];
+  const why = first?.description ?? run.limitations.find((l) => l.includes("could not be resolved"));
+  return [`No page could be loaded from ${run.target}.`, ...why ? [`  ${why}`] : [], ""];
 }
 var audit = {
   name: "audit",
@@ -49182,7 +49639,7 @@ var audit = {
   usage: "jourilo audit <url|dir> [--pages 6] [--viewports desktop,mobile] [--url /path ...] [--repo .] [--fail-on serious]",
   options: AUDIT_OPTIONS,
   details: `Options:
-  --pages N            Pages to audit after discovery (default 6; 1 = only the target)
+  --pages N            Pages to audit after discovery (default 6; 1 = only the target; 0 is a usage error)
   --depth N            Link depth for discovery (default 3)
   --url PATH           Audit exactly these paths/URLs on the target origin (repeatable; skips discovery)
   --include PATH       Add pages to discovery (repeatable)
@@ -49204,6 +49661,8 @@ var audit = {
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
+  --deny-local         Refuse local targets (localhost, 127.0.0.1, [::1], *.localhost, *.test) (exit 3); a redirect or request to one is blocked by the network guard and listed in the limitations;
+                       JOURILO_DENY_LOCAL=1 does the same. Not available with --browser webkit (exit 3). For hosted integrations; a directory target is still served
   --no-forms           Skip the form validation probe
                        (by default, on local hosts, an empty submission is simulated: nothing that sends data
                        leaves the browser, so no database is written; server-side feedback is reported as untested)
@@ -49213,9 +49672,11 @@ var audit = {
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
   --evidence MODE      full (default) or minimal: keep first screens and only the full-page screenshots findings need; JPEG quality 55
-  --run-id ID          Use this run id instead of a generated one (1-64 of A-Z a-z 0-9 _ -); refused if the run exists
-  --max-duration SECS  Stop after this many seconds and write a partial run (exit 6), as SIGINT/SIGTERM do;
-                       a second signal quits at once (exit 130)`,
+  --run-id ID          Use this run id instead of a generated one (1-64 of A-Z a-z 0-9 _ -); refused (exit 2) if its
+                       directory exists, even without a run.json (left by a crashed run)
+  --max-duration SECS  Stop after this many seconds (1 to 86400) and write a partial run (exit 6), as SIGINT/SIGTERM do;
+                       the page in progress gets up to 3 s to finish, then it is left out; a second signal quits at
+                       once (exit 130) after one line on stderr (STOPPED_TWICE with --json)`,
   run: (ctx) => auditCommand(ctx, audit.usage)
 };
 var accessibility = {
@@ -49263,18 +49724,33 @@ async function benchFixture(dir, wsRoot) {
       context: loadContext(dir)
     });
     locateFindings(run, dir);
-    const missed = expected.mustFind.filter((e) => !run.findings.some((f) => matches(f, e)));
+    const evidenceOk = (f, e) => {
+      if (!e.evidenceExactly) return true;
+      const texts = f.evidence.map((ev) => `${ev.snippet ?? ""} ${ev.selector ?? ""}`);
+      return texts.length > 0 && texts.every((t) => e.evidenceExactly.some((n) => t.includes(n))) && e.evidenceExactly.every((n) => texts.some((t) => t.includes(n)));
+    };
+    const missed = expected.mustFind.filter(
+      (e) => !run.findings.some((f) => matches(f, e) && evidenceOk(f, e))
+    );
     for (const r of expected.recommendations ?? []) {
       const f = run.findings.find((x) => matches(x, r));
       if (!f?.recommendation.includes(r.includes))
         missed.push({ rule: r.rule, path: r.path, why: `recommendation should include "${r.includes}"` });
     }
     const falsePositives = expected.mustNotFind.filter((e) => run.findings.some((f) => matches(f, e))).map((e) => ({ rule: e.rule, path: e.path, ...e.why ? { why: e.why } : {} }));
-    const excessDefects = expected.maxDefects ? run.findings.filter(
-      (f) => f.kind === "defect" && severityRank(f.severity) <= severityRank(expected.maxDefects.minSeverity)
-    ).filter(
-      (f) => !expected.maxDefects.paths || expected.maxDefects.paths.includes(pathOf2(f.url).split("?")[0].replace(/\/$/, "") || "/")
-    ).map((f) => ({ rule: f.ruleId, path: pathOf2(f.url), severity: f.severity })) : [];
+    const limits = expected.maxDefects ? [expected.maxDefects].flat() : [];
+    const excessDefects = [];
+    for (const lim of limits) {
+      const over = [];
+      for (const f of run.findings) {
+        if (f.kind !== "defect" || severityRank(f.severity) > severityRank(lim.minSeverity)) continue;
+        if (lim.rule && f.ruleId !== lim.rule) continue;
+        if (lim.paths && !lim.paths.includes(pathOf2(f.url).split("?")[0].replace(/\/$/, "") || "/"))
+          continue;
+        over.push({ rule: f.ruleId, path: pathOf2(f.url), severity: f.severity });
+      }
+      excessDefects.push(...over.slice(0, Math.max(0, over.length - lim.count)));
+    }
     const sourceMisses = [];
     for (const s of expected.sources ?? []) {
       const f = run.findings.find((x) => matches(x, { rule: s.rule, path: s.path }));
@@ -49287,10 +49763,7 @@ async function benchFixture(dir, wsRoot) {
       expected: expected.mustFind.length,
       missed,
       falsePositives,
-      excessDefects: excessDefects.slice(
-        0,
-        Math.max(0, excessDefects.length - (expected.maxDefects?.count ?? 0))
-      ),
+      excessDefects,
       sourceHits: (expected.sources?.length ?? 0) - sourceMisses.length,
       sourceExpected: expected.sources?.length ?? 0,
       sourceMisses,
@@ -49365,21 +49838,21 @@ var bench = {
 };
 
 // src/cli/commands/discover.ts
-import { existsSync as existsSync16, statSync as statSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync16, statSync as statSync7, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join21, resolve as resolve8 } from "node:path";
 
 // src/discovery/repo.ts
 init_fs_safety();
-import { existsSync as existsSync15, readdirSync as readdirSync11, readFileSync as readFileSync14, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync15, readdirSync as readdirSync11, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
 import { basename as basename5, dirname as dirname8, join as join20, relative as relative5 } from "node:path";
 
 // src/discovery/laravel.ts
 init_fs_safety();
-import { existsSync as existsSync14, readdirSync as readdirSync10, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync14, readdirSync as readdirSync10, readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
 import { basename as basename4, dirname as dirname7, join as join19, relative as relative4 } from "node:path";
 function read(file2) {
   try {
-    return statSync6(file2).size > 4e5 ? "" : readFileSync13(file2, "utf8");
+    return statSync5(file2).size > 4e5 ? "" : readFileSync13(file2, "utf8");
   } catch {
     return "";
   }
@@ -49622,7 +50095,7 @@ function walk(root, max = 2e4) {
       const full = join20(dir, n);
       let st;
       try {
-        st = statSync7(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
@@ -49642,7 +50115,7 @@ function readJson2(file2) {
 }
 function read2(file2, max = 4e5) {
   try {
-    const st = statSync7(file2);
+    const st = statSync6(file2);
     if (st.size > max) return "";
     return readFileSync14(file2, "utf8");
   } catch {
@@ -50248,20 +50721,23 @@ function siteText(p) {
 var discover = {
   name: "discover",
   summary: "Product intelligence: map a repository (frameworks, routes, design system, i18n, auth, analytics) or a website (pages, conversion points, services).",
-  usage: "jourilo discover <path|url> [--pages 10] [--ignore-robots] [--allow-private]",
+  usage: "jourilo discover <path|url> [--pages 10] [--ignore-robots] [--allow-private] [--deny-local]",
   options: {
     pages: { type: "string" },
     "allow-private": { type: "boolean" },
+    "deny-local": { type: "boolean" },
     "ignore-robots": { type: "boolean" }
   },
   details: `Options:
   --pages N         Pages to read when mapping a website (default 10)
   --ignore-robots   Ignore robots.txt (only for sites you own or are authorized to test)
-  --allow-private   Allow private-network hosts (10.x, 192.168.x, ...)`,
+  --allow-private   Allow private-network hosts (10.x, 192.168.x, ...)
+  --deny-local      Refuse local targets (localhost, 127.0.0.1, [::1], *.localhost, *.test) (exit 3); a redirect or request to one is blocked by the network guard and listed in the limitations;
+                    JOURILO_DENY_LOCAL=1 does the same`,
   async run(ctx) {
     const target = requirePositional(ctx, 0, "path|url", discover.usage);
     ctx.ws.ensure();
-    if (!target.includes("://") && existsSync16(target) && statSync8(target).isDirectory()) {
+    if (!target.includes("://") && existsSync16(target) && statSync7(target).isDirectory()) {
       const profile2 = discoverRepository(resolve8(target));
       const file3 = join21(ctx.ws.root, "product.json");
       writeFileSync10(file3, `${JSON.stringify(profile2, null, 2)}
@@ -50273,12 +50749,13 @@ var discover = {
     const { run, observations } = await runAudit(ctx.ws, {
       target,
       viewports: parseViewports("desktop"),
-      maxPages: num(ctx, "pages", 10),
+      maxPages: pagesOption(ctx, 10),
       maxDepth: 3,
       browser: "chromium",
       headed: false,
       respectRobots: !flag(ctx, "ignore-robots"),
       allowPrivate: flag(ctx, "allow-private"),
+      ...denyLocalFrom(ctx) ? { denyLocal: true } : {},
       keyboard: false,
       throttle: false,
       timeoutMs: 3e4,
@@ -51042,14 +51519,7 @@ function metricVerdict(name, a, b) {
   }
   return Math.abs(delta) < (RESOLUTION[name] ?? 0) ? "noise" : "unconfirmed";
 }
-function pathKey(u) {
-  try {
-    const x = new URL(u);
-    return `${x.pathname}${x.search}`;
-  } catch {
-    return u;
-  }
-}
+var pathKey = fingerprintPath;
 function compareRuns(base2, head) {
   const before = new Map(base2.findings.map((f) => [f.fingerprint, f]));
   const after = new Map(head.findings.map((f) => [f.fingerprint, f]));
@@ -51207,6 +51677,24 @@ function metricSummary(metrics) {
     );
   return lines;
 }
+function verifyTargetUrl(target) {
+  const hint = "Give a directory to serve, or a URL that starts with http:// or https://.";
+  if (existsSync19(target))
+    throw new JouriloError("INVALID_INPUT", `--target ${target} is a file, not a directory or a URL.`, hint);
+  let url;
+  try {
+    url = new URL(target);
+  } catch {
+    url = void 0;
+  }
+  if (!url || url.protocol !== "http:" && url.protocol !== "https:" || !url.hostname)
+    throw new JouriloError(
+      "INVALID_INPUT",
+      `--target ${target} is neither an existing directory nor an http(s) URL.`,
+      hint
+    );
+  return url;
+}
 var verify = {
   name: "verify",
   summary: "Repeat a run with the same scope (pages, viewports) after a change and compare: fixed, new, persisting, metric deltas.",
@@ -51214,25 +51702,31 @@ var verify = {
   options: {
     target: { type: "string" },
     "fail-on-regression": { type: "boolean" },
+    "deny-local": { type: "boolean" },
     repo: { type: "string" }
   },
   details: `Options:
   --target URL|DIR       Where to repeat the audit (default: the baseline run's target)
   --repo PATH            Repository for source mapping (default: the baseline run's repo)
+  --deny-local           Refuse a local target (localhost, 127.0.0.1, [::1], *.localhost, *.test) with exit 3; a redirect to one is blocked by the network guard and listed in the limitations;
+                         JOURILO_DENY_LOCAL=1 does the same. Not available with --browser webkit (exit 3)
   --fail-on-regression   Exit 1 when new serious or critical defects appear`,
   async run(ctx) {
+    const target = str(ctx, "target");
+    const targetDir = target !== void 0 && isDirectoryTarget(target);
+    const targetUrl = target !== void 0 && !targetDir ? verifyTargetUrl(target) : void 0;
     const base2 = ctx.ws.loadRun(ctx.positionals[0] ?? "latest").run;
+    refuseDenyLocalWebkit(denyLocalFrom(ctx), String(base2.browser.name ?? "chromium"));
     const scope = base2.settings.scope;
     if (!scope)
       throw new JouriloError(
         "INVALID_INPUT",
         `Run ${base2.id} has no recorded scope (created by an older version or by journeys).`
       );
-    const target = str(ctx, "target");
-    const servedDir = target ? existsSync19(target) ? resolve9(target) : void 0 : base2.settings.servedDir;
+    const servedDir = target !== void 0 ? targetDir ? resolve9(target) : void 0 : base2.settings.servedDir;
     const server = servedDir ? await serveStatic(servedDir) : void 0;
     try {
-      const origin = server?.url ?? new URL(target ?? scope.urls[0]).origin;
+      const origin = server?.url ?? (targetUrl ?? new URL(scope.urls[0])).origin;
       const urls = scope.urls.map((u) => {
         const x = new URL(u);
         return `${x.pathname}${x.search}`;
@@ -51261,6 +51755,7 @@ var verify = {
         headed: false,
         respectRobots: base2.settings.respectRobots !== false,
         allowPrivate: base2.settings.hostClass === "private",
+        ...denyLocalFrom(ctx) ? { denyLocal: true, ...server ? { servedPort: servedPort(server) } : {} } : {},
         keyboard: base2.settings.keyboard !== false,
         throttle: base2.settings.throttle === true,
         // Same number of visits as the baseline, so medians are compared with medians.