testaro 78.4.0 → 78.6.0

package/.github/workflows/publish.yml

@@ -6,8 +6,11 @@
 # SPDX-License-Identifier: MIT
 
 # Publishes the package to npm when a GitHub release is published (the release tag must equal
-# v<package.json version>), or on manual dispatch. Authenticates with the NPM_TOKEN repository
-# secret, a granular access token with publish permission for the testaro package.
+# v<package.json version>), or on manual dispatch. Authenticates by npm trusted publishing:
+# the job's GitHub OIDC token (permissions.id-token: write) identifies this repository and
+# workflow file to npm, which is configured on npmjs.com (package testaro, trusted publisher
+# GitHub Actions, YRA-Tech/testaro, publish.yml) to accept publishes from it. No npm token is
+# involved; a NODE_AUTH_TOKEN would take precedence over OIDC, so none is set.
 # prepublishOnly regenerates the rule registry and the emitted TypeScript, and the version
 # check refuses a release tag that does not match.
 
@@ -45,5 +48,3 @@ jobs:
       - run: npm run lint
       - run: npm run typecheck
       - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/CLAUDE.md

@@ -83,7 +83,7 @@ Key variables:
 - `JOBDIR` / `REPORTDIR` — root directories for job files and report output
 - `NETWATCH_URL_JOB`/`NETWATCH_URL_REPORT`/`NETWATCH_AUTH_TYPE`/`NETWATCH_WORKER_ID`/`NETWATCH_WORKER_SECRET` — server polling configuration
 - `TIMEOUT_MULTIPLIER` — scales all per-tool time limits (default 1)
-- `NAV_WAIT_UNTIL`/`NAV_TIMEOUT`/`NAV_FAIL_FAST_4XX`, `SCANNER_ID`, `PRESCAN_SCROLL`, `TESTARO_RULE_RETRIES`, `QUALWEB_STEALTH`/`QUALWEB_ADBLOCK` — deployment defaults that job properties (`navigation`, `scannerId`, `scroll`, `browserChannel`; `retries`, `stealth`, `adBlock` on test acts) override (`procs/config.js`)
+- `NAV_WAIT_UNTIL`/`NAV_TIMEOUT`/`NAV_FAIL_FAST_4XX`, `SCANNER_ID`, `PRESCAN_SCROLL`, `TESTARO_RULE_RETRIES` — deployment defaults that job properties (`navigation`, `scannerId`, `scroll`, `browserChannel`; `retries` on test acts) override (`procs/config.js`). (`QUALWEB_STEALTH`/`QUALWEB_ADBLOCK` and a `qualWeb` act's `stealth`/`adBlock` no longer have any effect: qualWeb runs in the page under test.)
 
 ## Code style
 

package/README.md

@@ -8,6 +8,8 @@ Version 75.0.0 introduced a breaking change in the methods for making screenshot
 
 Version 68.0.0 introduced a breaking change in the format of reports.
 
+Changes in each version since 73.0.0 are listed in [Version change notes](#version-change-notes).
+
 ## Purposes
 
 Testaro is an application that performs ensemble testing of web pages for accessibility, usability, and conformity to HTML and CSS specifications.
@@ -131,7 +133,7 @@ git pull
 
 The `.env` file stores your decisions about the environment in which Testaro runs. The variables that can be defined there are documented in the `env.example` file.
 
-Deployment options let an operator set a fleet-wide policy that a job can override: the load state and time limit a navigation waits for and whether a 4xx response ends launch retries at once (`NAV_WAIT_UNTIL`, `NAV_TIMEOUT`, `NAV_FAIL_FAST_4XX`, or a job's `navigation` property); a scanner identity sent as the `X-YRA-Scanner` request header (`SCANNER_ID` or a job's `scannerId`); a full-page scroll after navigation so lazily loaded content is present (`PRESCAN_SCROLL` or a job's `scroll`); a branded Chromium channel (a job's `browserChannel`); launch retries per rule of the `testaro` tool (`TESTARO_RULE_RETRIES` or a `testaro` test act's `retries`); and whether the `qualWeb` tool's browser runs stealth evasions and blocks ads and trackers (`QUALWEB_STEALTH`, `QUALWEB_ADBLOCK`, or a `qualWeb` test act's `stealth` and `adBlock`). The defaults keep the behavior of earlier versions.
+Deployment options let an operator set a fleet-wide policy that a job can override: the load state and time limit a navigation waits for and whether a 4xx response ends launch retries at once (`NAV_WAIT_UNTIL`, `NAV_TIMEOUT`, `NAV_FAIL_FAST_4XX`, or a job's `navigation` property); a scanner identity sent as the `X-YRA-Scanner` request header (`SCANNER_ID` or a job's `scannerId`); a full-page scroll after navigation so lazily loaded content is present (`PRESCAN_SCROLL` or a job's `scroll`); a branded Chromium channel (a job's `browserChannel`); launch retries per rule of the `testaro` tool (`TESTARO_RULE_RETRIES` or a `testaro` test act's `retries`); and which rule engine the `ibm` tool runs (`IBM_ENGINE`: `archive`, the default, for the rule archive IBM deploys, which can lag the npm package; or `package`, for the engine released with the installed `accessibility-checker`, which IBM's published ACT report describes). The defaults keep the behavior of earlier versions.
 
 ## Jobs
 
@@ -702,6 +704,74 @@ On 12 February 2024 ownership of the Testaro repository was transfered from the
 
 Maintenance of the repository owned by CVS Health came to an end on 30 September 2025. The current repository was forked from the `cvs-health` repository in October 2025 and then unlinked from the fork network, by agreement with CVS Health.
 
+## Version change notes
+
+These notes cover versions from 73.0.0 (May 2026) onward. The date of each version is its npm publication date, except that versions marked “unpublished” were committed but not published to npm, and their changes first reached npm in the next published version. Changes in earlier versions are recorded in the commit history.
+
+### 78
+
+- **78.6.0** (20 October 2026). An outbound proxy for every browser Testaro launches: `TESTARO_PROXY` (an http, https, or socks5 URL, with any credentials) routes the browsers' traffic through that proxy, so tested sites see its address rather than the host's. WebRTC is confined to the proxy in Chromium and Firefox. A malformed value stops launches instead of connecting directly. Nothing changes when the variable is unset (#173).
+- **78.5.0** (24 September 2026). The `qualWeb` tool runs in the page under test. It used to give QualWeb the serialized page, which QualWeb loaded into a blank page of its own browser, where relative stylesheet links resolved nowhere, so it tested an unstyled page. CSS-dependent rules (contrast `QW-ACT-R37` and `QW-ACT-R76`, zoomed-text clipping `QW-ACT-R40`, the colour techniques) now see the page's real styles, and their counts change accordingly. A QualWeb rule that throws is excluded and recorded in the act's `data.rulePreventions` instead of failing its whole section (for example `QW-ACT-R76` on `lab()`, `oklab()`, `color()` and `color-mix()` colours, qualweb/qualweb#352). A `qualWeb` act's `stealth` and `adBlock` properties, and `QUALWEB_STEALTH` and `QUALWEB_ADBLOCK`, no longer have any effect. The `ibm` tool's rule engine is selectable with `IBM_ENGINE` (`archive`, the default, or `package`). The ACT validation harness (`validation/act/`) records rule-level outcomes and per-page element snapshots.
+- **78.4.0** (2 September 2026). The first npm publication since 78.0.8; it includes the changes of the unpublished versions 78.1.0 through 78.3.0. Deployment options, each a job property when set, else an environment variable, else the earlier behavior: the load state, time limit, and fail-fast-on-4xx policy of navigation (`navigation`; `NAV_WAIT_UNTIL`, `NAV_TIMEOUT`, `NAV_FAIL_FAST_4XX`), a scanner identity request header (`scannerId`; `SCANNER_ID`), a full-page scroll before testing (`scroll`; `PRESCAN_SCROLL`), a branded Chromium channel (`browserChannel`), launch retries per rule of the `testaro` tool (act `retries`; `TESTARO_RULE_RETRIES`), and stealth and ad blocking for the `qualWeb` tool (act `stealth` and `adBlock`; `QUALWEB_STEALTH`, `QUALWEB_ADBLOCK`), which the QualWeb driver had ignored and which are now provided by `playwright-extra` and `@ghostery/adblocker-playwright`. A GitHub Actions workflow publishes the package to npm when a GitHub release is created whose tag matches the package version.
+- **78.3.0** (2 September 2026, unpublished). Checkpoints (see [Checkpoints](#checkpoints) and `docs/checkpoint-scanning.md`): a `checkpoint` act snapshots a page state reached by the acts of a job, and test acts test the latest checkpoint, reaching it by replaying the recorded interaction acts; an `isolation` job property (`process`, `browser`, or `page`) governs how test acts are isolated; when a job has two or more checkpoints, the report gains a `flow` property listing the issues added, persisted, removed, and not retested between consecutive checkpoints, with catalog-structure and ARIA-snapshot diffs; a test act may have `scope: 'changed'` to test only the subtrees changed since the previous checkpoint; interaction acts may identify elements by a Playwright `selector`; catalog entries not cited by any test act are pruned incrementally; `procs/userPath.js` converts recorded user paths into acts. Repairs to the act loop (`next`, failed launches, `url`, `state`).
+- **78.2.0** (1 September 2026, unpublished). Two new rule engines, `pour` (Pour Engine 1.37.0) and `surea11y` (SureA11y core 1.7.0), each vendored as a browser bundle, bringing the count of rule engines from 10 to 12. All rule validators pass again (47 had been quarantined in 78.0.8), legacy expectation paths are resolved from the catalog, and a harness in `validation/act/` scores engines against the W3C ACT test cases. Dependency updates.
+- **78.1.0** (1 September 2026, unpublished). Certainty on standard instances: every instance carries `outcome` (`failed` or `cantTell`), optionally `uncertainty` and `needed`, and the standard result gains `outcomeTotals`; `ordinalSeverity` and `totals` are unchanged, and a later major version will redefine `ordinalSeverity` as impact only (see `docs/standard-result-outcome.md`). TypeScript: the rule modules, tool adapters, core procs, and `types.ts` are TypeScript sources whose emitted `.js` and `.d.ts` files are committed, the package declares `types`, a generated registry (`testaro/registry.ts`) maps rule IDs to rule modules, and the `typecheck`, `build:ts`, `build:registry`, and `lint` scripts are added. The required Node.js version becomes `>=22.12`, and dependencies are pinned to caret ranges instead of `*`. Polling a server (`netWatch`): authentication by a `Basic` authorization header (`NETWATCH_AUTH_TYPE`, `NETWATCH_WORKER_ID`, `NETWATCH_WORKER_SECRET`), job and report URLs no longer assume fixed paths, TLS certificates are verified by default, HTTP statuses are checked, and reports whose delivery fails are saved under `REPORTDIR/netWatchFailed`; the `AGENT` and `NETWATCH_URL_AUTH` variables are deprecated but still honored. Fixes: `ordinalSeverity` is numeric in summary instances of `doTest` rules, `getBasicResult` awaits the catalog index, `styleDiff` chooses the first list link deterministically, `htmlcs` leaves standard totals empty when standard results are off, `ed11y` reports a prevented run instead of crashing, `browserClose` abandons a close that has not settled after 10 seconds, the `elements` rule loads again (a duplicate parameter name had made it a syntax error), and `executionTimeStamp` is validated. Repository URLs point to `YRA-Tech/testaro`, and CI runs the linter, the type check, and the rule validators.
+- **78.0.8** (20 August 2026). Copyright and license notices updated; a nonstandard directory removed.
+- **78.0.7** (unpublished). `getAttributeXPath` tolerates Nu Html Checker messages without an extract, which had thrown and lost the standardization of the whole act.
+- **78.0.6** (20 August 2026). `nuVal` and `nuVnu`: the extract of a message that identifies no element is preserved in the `what` property of the instance.
+- **78.0.5** (20 August 2026). `htmlcs`: the `define`, `exports`, and `module` globals are hidden while `HTMLCS.js` is injected, so pages that expose an AMD loader no longer prevent the tool.
+- **78.0.4** (19 August 2026). `focAll` reports the specific elements not reached by tabbing and those reached unexpectedly, itemized when `withItems` is true.
+- **78.0.3** (unpublished). The `accessibility-checker` dependency is required to be at least 4.0.29.
+- **78.0.2** (19 August 2026). `browserClose` actually closes the browser context and browser; previously every browser outlived its act.
+- **78.0.1** (19 August 2026). The time budget of the `motion` rule rises from 5 to 30 seconds.
+- **78.0.0** (19 August 2026). New optional `imageScale` job property: when it is greater than 1, the catalog page is rendered at that device scale factor and a second page image, at device-pixel scale, becomes the second item of `images`; the first item stays at CSS-pixel scale. The major version was incremented because of the added job property.
+
+### 77
+
+- **77.2.1** (19 August 2026). The catalog records no `boxID` for elements that are laid out but not painted (`visibility: hidden` and `content-visibility: hidden` subtrees).
+- **77.2.0** (19 August 2026). During a job the map from path IDs to catalog indexes lives at `report.pathIDs` instead of `catalog.pathID`, so the catalog contains only element entries; the shipped report is unchanged.
+- **77.1.0** (19 August 2026). Closed `details` elements are expanded before the page image and the box measurements are made, so the two agree.
+- **77.0.4** (18 August 2026). Validation: expectations of test acts are resolved against `act.result`, so `standardResult` expectation paths work.
+- **77.0.3** (18 August 2026). `normalizeURL` resolves relative path segments, so strict jobs with `file:` targets no longer report spurious bad redirections.
+- **77.0.2** (18 August 2026). `deSlash` is defined, so strict jobs no longer abort on their first navigation.
+- **77.0.1** (18 August 2026). `autocomplete`: its label arrays are spliced correctly, so the name, given-name, family-name, and email heuristics fire. The order in which navigation load-wait conditions are relaxed is improved. Dependency updates.
+- **77.0.0** (28 July 2026). Observability: `doJob` accepts a second argument with an `onProgress` callback and emits `jobStart`, `catalogStart`, `catalogEnd`, `actStart`, `actEnd`, and `jobEnd` events (see [Execution with observability](#execution-with-observability)).
+
+### 76
+
+- **76.2.2** (28 July 2026). Container versioning requirements documented; dependency updates.
+- **76.2.1** (28 July 2026). The catalog no longer fails on pages whose scripts extend `Array.prototype`.
+- **76.2.0** (27 July 2026). When a target repeatedly rejects a job, the job's `browserID` is changed.
+- **76.1.2** (27 July 2026). The launch context honors a user agent supplied by the job for device emulation instead of overriding it.
+- **76.1.1** (26 July 2026). Corrections related to containerization.
+- **76.1.0** (25 July 2026). The `qualWeb` tool uses the QualWeb Playwright driver instead of Puppeteer. Documentation and dependency updates.
+- **76.0.0** (18 July 2026). Containerized deployment: the `TESTARO_CHROMIUM_NO_SANDBOX` environment variable and a reference container image (`Dockerfile`, `docker-compose.yml`, `CONTAINERS.md`). Archived jobs and reports are named by ID in `run` and `dirWatch`, and a `dirWatch` file-deletion bug is corrected. The `validation/watch` directory is removed.
+
+### 75
+
+- **75.2.2** (18 July 2026). The `call` commands tolerate absent `netWatch` environment variables instead of failing.
+- **75.2.1** (20 June 2026). A failure to launch a browser for the catalog is fatal to the job.
+- **75.2.0** (20 June 2026). When a browser crashes on launch, the launch is retried with a different browser type, and browser-type changes are logged.
+- **75.1.0** (6 June 2026). New optional `imageColor` job property: when a catalog is created, a page image with that color type is made the first item of an `images` array in the report. The `motion` rule makes its own screenshot and compares it with that image, using `pixelmatch` instead of BlazeDiff.
+- **75.0.0** (5 June 2026). Breaking: the `shoot` act creates a full-page screenshot as a base64-encoded PNG and, with its `exclusionSelector`, `colorType`, and `action` properties, decides what to mask, which color type to use, and whether to return the image in the act result, add it to the `images` array of the report, or save it as a file; the screenshot option of the `launch` act is removed.
+
+### 74
+
+- **74.2.3** (3 June 2026). `axe`: the full `data-xpath` of each flagged element is resolved from the live DOM, because axe truncates the HTML it reports. Dependency updates.
+- **74.2.2** (29 May 2026). Additions to `UPGRADES.md`.
+- **74.2.1** (26 May 2026). WebKit and Firefox are imported from `playwright-extra` again; 74.2.0 had imported only Chromium.
+- **74.2.0** (25 May 2026). The stealth plugin is applied only to Chromium; WebKit and Firefox had rejected a Chromium-only launch option and failed every job.
+- **74.1.3** (25 May 2026). The `TESTARO_NU_URL` environment variable overrides the URL of the Nu Html Checker, for a self-hosted checker without the body-size limit of the public one.
+- **74.1.2** (25 May 2026). `nuVal` survives empty responses from the W3C validator instead of losing the underlying error.
+- **74.1.1** (25 May 2026). The exclude-list form of the `testaro` rule specification (`['n', …]`) actually excludes the listed rules.
+- **74.1.0** (25 May 2026). Job-level `stealth` toggle.
+- **74.0.1** (25 May 2026). Copyright notices updated.
+- **74.0.0** (25 May 2026). New `shoot` act type, making full-page screenshots.
+
+### 73
+
+- **73.0.0** (25 May 2026). Temporary files are kept in a per-job directory under `tmp` at the project root, falling back to the operating system's temporary directory; the `TMPDIRNAME` environment variable and `procs/config.js` are removed.
+
 ## Contributing
 
 From 12 February 2024 through 30 September 2025, contributors of code to Testaro executed a [CVS Health OSS Project Contributor License Agreement](https://forms.office.com/pages/responsepage.aspx?id=uGG7-v46dU65NKR_eCuM1xbiih2MIwxBuRvO0D_wqVFUQ1k0OE5SVVJWWkY4MTVJMkY3Sk9GM1FHRC4u) for Testaro before any pull request was approved and merged.

package/actSpecs-doc.md

@@ -57,7 +57,7 @@ The validity criterion named in item 2 may be any of these:
 
 ## qualWeb tool
 
-A `qualWeb` test act may have `stealth` and `adBlock` boolean properties, which set whether the tool's browser runs stealth evasions and blocks ads and trackers (defaults `QUALWEB_STEALTH` and `QUALWEB_ADBLOCK`, else true).
+QualWeb runs in the page under test (as the page is after launch and any earlier acts), with that page's styles and scripts, not in a browser of its own. A rule that throws is excluded and its section rerun; the act's `data.rulePreventions` records such rules (and any section that failed as a whole). The `stealth` and `adBlock` properties a `qualWeb` test act may still have are accepted and ignored: they configured the separate browser QualWeb used to launch.
 
 ## testaro tool
 

package/actSpecs.js

@@ -215,8 +215,8 @@ exports.actSpecs = {
     qualWeb: [
       'Perform QualWeb tests',
       {
-        stealth: [false, 'boolean', '', 'whether the browser runs stealth evasions (default QUALWEB_STEALTH, else true)'],
-        adBlock: [false, 'boolean', '', 'whether the browser blocks ads and trackers (default QUALWEB_ADBLOCK, else true)']
+        stealth: [false, 'boolean', '', 'ignored: qualWeb runs in the page under test, not in a browser of its own'],
+        adBlock: [false, 'boolean', '', 'ignored: qualWeb runs in the page under test, not in a browser of its own']
       }
     ],
     testaro: [

package/dist/nameComputation.js

@@ -1,3 +1,4 @@
+"use strict";
 var computeAccessibleName = (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
   var __commonJS = (cb, mod) => function __require() {

package/env.example

@@ -44,10 +44,10 @@ PRESCAN_SCROLL=false
 # Launch retries per rule of the testaro tool, which relaunches per contaminating rule
 # (default 2; raise for non-Chromium browsers, which navigate flakily on relaunch).
 TESTARO_RULE_RETRIES=2
-# Whether the qualWeb tool's browser runs stealth evasions and blocks ads and trackers
-# (default true; a qualWeb test act may set stealth and adBlock).
-QUALWEB_STEALTH=true
-QUALWEB_ADBLOCK=true
+# No longer used: the qualWeb tool now runs in the page under test instead of its own
+# browser, so it has no stealth or ad-blocking settings of its own.
+# QUALWEB_STEALTH=true
+# QUALWEB_ADBLOCK=true
 # URL of any non-default (e.g., self-hosted) Nu Html Checker API (see ghcr.io/validator/validator).
 TESTARO_NU_URL=__placeholder__
 # Whether to launch the Playwright chromium browser without its sandbox (normally false).
@@ -55,6 +55,11 @@ TESTARO_NU_URL=__placeholder__
 # seccomp policies and some hardened hosts prohibit. Set this to true in containers,
 # or run containers with a seccomp profile that permits user-namespace cloning.
 TESTARO_CHROMIUM_NO_SANDBOX=false
+# URL (http, https, or socks5, with any credentials) of an outbound proxy for every browser
+# Testaro launches, including the qualWeb tool's, so tested sites see the proxy's address
+# rather than the host's (default none: browsers connect directly). A malformed value stops
+# launches instead of connecting directly.
+TESTARO_PROXY=
 
 # netWatch variables
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testaro",
-  "version": "78.4.0",
+  "version": "78.6.0",
   "description": "Run 1300 web accessibility tests from 12 tools and get a standardized report",
   "main": "run.js",
   "scripts": {

package/procs/config.d.ts

@@ -33,3 +33,9 @@ export function getScroll(report: unknown): boolean;
 export const ruleLaunchRetries: number;
 // Defaults for the qualWeb tool's browser.
 export const qualWebDefaults: {stealth: boolean; adBlock: boolean};
+// Launch options routing a browser through the outbound proxy (TESTARO_PROXY), or {} if none.
+export function getProxyLaunchOptions(browserID: string): {
+  proxy?: {server: string; username?: string; password?: string};
+  args?: string[];
+  firefoxUserPrefs?: Record<string, boolean>;
+};

package/procs/config.js

@@ -79,3 +79,39 @@ exports.qualWebDefaults = {
   stealth: envFlag('QUALWEB_STEALTH', true),
   adBlock: envFlag('QUALWEB_ADBLOCK', true)
 };
+// Returns the launch options that route a browser of the specified type through the outbound
+// proxy (TESTARO_PROXY: an http, https, or socks5 URL, with any credentials), so that tested
+// sites see the proxy's address rather than the host's; or {} if none is configured. Applies
+// to every browser Testaro launches, including the qualWeb tool's. A malformed value throws
+// instead of falling back to a direct connection that would expose the host's address. The
+// browser's WebRTC traffic is confined to the proxy where the browser permits (Chromium and
+// Firefox; WebKit has no such launch option), since WebRTC UDP bypasses an HTTP proxy.
+exports.getProxyLaunchOptions = browserID => {
+  const value = (process.env.TESTARO_PROXY || '').trim();
+  if (! value) {
+    return {};
+  }
+  let url;
+  try {
+    url = new URL(value);
+  }
+  // The value is not quoted in errors, because it may contain credentials.
+  catch {
+    throw new Error('TESTARO_PROXY is not a URL');
+  }
+  if (! ['http:', 'https:', 'socks5:'].includes(url.protocol) || ! url.hostname) {
+    throw new Error('TESTARO_PROXY is not an http, https, or socks5 URL with a host');
+  }
+  const proxy = {server: `${url.protocol}//${url.host}`};
+  if (url.username) {
+    proxy.username = decodeURIComponent(url.username);
+    proxy.password = decodeURIComponent(url.password);
+  }
+  if (browserID === 'chromium') {
+    return {proxy, args: ['--force-webrtc-ip-handling-policy=disable_non_proxied_udp']};
+  }
+  if (browserID === 'firefox') {
+    return {proxy, firefoxUserPrefs: {'media.peerconnection.ice.proxy_only': true}};
+  }
+  return {proxy};
+};

package/procs/launch.js

@@ -34,8 +34,8 @@ const playwrightExtra = require('playwright-extra');
 const {isBrowserID, isDeviceID, isURL, isValidJob} = require('./job');
 // The in-page script defining window.getXPath.
 const {getXPathSource} = require('./xPathScript');
-// Deployment options (navigation, scanner identity, pre-scan scroll).
-const {getNavigation, getScannerId, getScroll, waitStates} = require('./config');
+// Deployment options (navigation, scanner identity, pre-scan scroll, outbound proxy).
+const {getNavigation, getProxyLaunchOptions, getScannerId, getScroll, waitStates} = require('./config');
 
 // CONSTANTS
 
@@ -465,6 +465,10 @@ const launchOnce = async opts => {
       // Disable the sandbox.
       browserOptions.chromiumSandbox = false;
     }
+    // Route the browser through the outbound proxy, if one is configured.
+    const {args: proxyArgs = [], ...proxyOptions} = getProxyLaunchOptions(browserID);
+    browserOptionArgs.push(...proxyArgs);
+    Object.assign(browserOptions, proxyOptions);
     // If the job specifies a branded Chromium channel (chrome or msedge), run that installed
     // browser instead of the bundled Chromium build; bundled or absent keeps the default.
     const {browserChannel} = report;

package/tests/ibm.d.ts

@@ -34,6 +34,11 @@ type IbmTrimmedReport = {
     items: IbmItem[];
     error: string;
 };
+export type IbmEngineMode = 'archive' | 'package';
+export declare const ibmEngine: () => Promise<{
+    mode: IbmEngineMode;
+    version: string | null;
+}>;
 export declare const reporter: (page: Page, report: Report, actIndex: number) => Promise<{
     data: {};
     result: {

package/tests/ibm.js

@@ -10,26 +10,35 @@
   SPDX-License-Identifier: MIT
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reporter = void 0;
+exports.reporter = exports.ibmEngine = void 0;
 const xPath_1 = require("../procs/xPath");
 const standard_1 = require("../procs/standard");
 const accessibilityChecker = require('accessibility-checker');
-const { getCompliance } = accessibilityChecker;
-/*
-  ibm
-  Implements the IBM Equal Access ruleset for accessibility.
-
-  This rule engine depends on aceconfig.js.
-
-  This rule engine is compatible with Windows only if the accessibility-checker package
-  is revised. See README.md for details.
-  Compiled to ibm.js by tsc (issue #73); edit this file, not the emitted one.
-*/
-// FUNCTIONS
+const { getCompliance, getConfig } = accessibilityChecker;
+let engineSelection = null;
+const ibmEngine = () => {
+    engineSelection ??= (async () => {
+        const requested = (process.env.IBM_ENGINE || 'archive').trim().toLowerCase();
+        if (!['archive', 'package'].includes(requested)) {
+            console.log(`WARNING: IBM_ENGINE=${process.env.IBM_ENGINE} is not archive or package; using archive`);
+        }
+        const mode = requested === 'package' ? 'package' : 'archive';
+        const config = await getConfig();
+        if (mode === 'package' && config.toolVersion) {
+            config.rulePack = `https://cdn.jsdelivr.net/npm/accessibility-checker-engine@${config.toolVersion}`;
+            config.ruleArchiveVersion = config.toolVersion;
+            config.ruleArchiveLabel = `accessibility-checker-engine ${config.toolVersion} (package)`;
+        }
+        return { mode, version: config.ruleArchiveVersion ?? null };
+    })();
+    return engineSelection;
+};
+exports.ibmEngine = ibmEngine;
 // Runs the IBM test and returns the result.
 const run = async (content) => {
     const nowLabel = (new Date()).toISOString().slice(0, 19);
     try {
+        await (0, exports.ibmEngine)();
         const ibmReport = await getCompliance(content, nowLabel);
         if (typeof ibmReport === 'object' && ibmReport.report) {
             return ibmReport;

package/tests/ibm.ts

@@ -16,7 +16,7 @@ import {getAttributeXPath, getXPathCatalogIndex} from '../procs/xPath';
 import {getStandardResult, pushInstance} from '../procs/standard';
 import type {Act, Report, StandardInstance, StandardResult} from '../types';
 const accessibilityChecker = require('accessibility-checker') as typeof import('accessibility-checker');
-const {getCompliance} = accessibilityChecker;
+const {getCompliance, getConfig} = accessibilityChecker;
 
 // TYPES
 
@@ -69,10 +69,46 @@ type IbmTrimmedReport =
 
 // FUNCTIONS
 
+/*
+  Which IBM rule engine runs, per the IBM_ENGINE environment variable:
+    archive (default): the rule archive IBM deploys ("latest"), which is what
+      users of IBM's own tools get. It can lag the npm package (engine 4.0.27
+      under accessibility-checker 4.0.33 in September 2026).
+    package: the engine released with the installed accessibility-checker,
+      the one IBM's published ACT report describes. It is fetched from the
+      same CDN as the archive's.
+  accessibility-checker reads aceconfig.js from the working directory and then
+  ignores a configuration passed to it, so the package engine is selected by
+  adjusting its processed configuration before the first test. Setting
+  ruleArchiveVersion also keeps the two engines' cached files apart and makes
+  getConfig report the engine actually used.
+*/
+export type IbmEngineMode = 'archive' | 'package';
+let engineSelection: Promise<{mode: IbmEngineMode; version: string | null}> | null = null;
+export const ibmEngine = () => {
+  engineSelection ??= (async () => {
+    const requested = (process.env.IBM_ENGINE || 'archive').trim().toLowerCase();
+    if (! ['archive', 'package'].includes(requested)) {
+      console.log(`WARNING: IBM_ENGINE=${process.env.IBM_ENGINE} is not archive or package; using archive`);
+    }
+    const mode: IbmEngineMode = requested === 'package' ? 'package' : 'archive';
+    const config = await getConfig() as unknown as {
+      toolVersion?: string; rulePack?: string; ruleArchiveVersion?: string; ruleArchiveLabel?: string;
+    };
+    if (mode === 'package' && config.toolVersion) {
+      config.rulePack = `https://cdn.jsdelivr.net/npm/accessibility-checker-engine@${config.toolVersion}`;
+      config.ruleArchiveVersion = config.toolVersion;
+      config.ruleArchiveLabel = `accessibility-checker-engine ${config.toolVersion} (package)`;
+    }
+    return {mode, version: config.ruleArchiveVersion ?? null};
+  })();
+  return engineSelection;
+};
 // Runs the IBM test and returns the result.
 const run = async (content: Page) => {
   const nowLabel = (new Date()).toISOString().slice(0, 19);
   try {
+    await ibmEngine();
     const ibmReport = await getCompliance(content, nowLabel);
     if (typeof ibmReport === 'object' && ibmReport.report) {
       return ibmReport as unknown as {report: IbmActReport};

package/tests/qualWeb.d.ts

@@ -20,9 +20,8 @@ interface QwModuleReport {
 }
 interface QwNativeResult {
     system?: {
-        page?: {
-            dom?: unknown;
-        };
+        url?: string;
+        evaluation?: string;
     };
     modules?: Record<string, QwModuleReport>;
 }
@@ -30,6 +29,7 @@ export declare const reporter: (page: Page, report: Report, actIndex: number, ti
     data: {
         prevented?: boolean;
         error?: string;
+        rulePreventions?: Record<string, string>;
     };
     result: {
         nativeResult: QwNativeResult;