Expand utils tree with web-platform, security, perf, AI, and governance modules

Adds 73 modules across the testing lifecycle: WebTransport / IndexedDB / File
System Access / Notifications instrumentation; mixed-content / clickjacking /
open-redirect / SRI / COOP-COEP audits; INP / hydration / bundle / 3p / LoAF
budgets; gRPC / webhook / idempotency / pagination integration helpers; AI
narrator / repro-minimizer / locator-hardener / categorizer; quarantine-age,
test-debt, SLA, repro-stability, and CODEOWNERS reports. Each ships with a
focused unit-test file.

Author: JE-Chen

CLAUDE.md

@@ -45,7 +45,80 @@ je_web_runner/
     ├── socket_server/       # TCP socket server for remote control
     ├── test_object/         # Test object & record classes (Value Object pattern)
     ├── test_record/         # Action recording
-    └── xml/                 # XML utilities
+    ├── xml/                 # XML utilities
+    ├── chrome_profile/      # Persistent Chrome profile + stealth + snapshot/sync-back
+    ├── failure_triage/      # AI failure root-cause analysis on failure bundles
+    ├── flake_detector/      # Time-decayed flake scoring + quarantine registry
+    ├── locator_health/      # Project-wide locator audit + upgrade suggestions
+    ├── device_cloud/        # Real-device cloud (BrowserStack/Sauce/LambdaTest) connector
+    ├── otel_bridge/         # W3C traceparent injection for distributed tracing
+    ├── mutation_testing/    # Action JSON mutation testing (kill rate / score)
+    ├── otp_interceptor/     # MailHog/Mailpit/IMAP/SMS OTP polling for 2FA flows
+    ├── download_verify/     # PDF / CSV / Excel / JSON / SHA256 download assertions
+    ├── test_auto_repair/    # LLM-driven test rewrite from failure + git diff
+    ├── edge_case_generator/ # LLM edge-case variant generator (complement to mutation_testing)
+    ├── openapi_to_e2e/      # OpenAPI/Swagger spec → WR_http_* action JSON
+    ├── cross_tab_sync/      # Multi-page BroadcastChannel / storage propagation asserts
+    ├── visual_ai/           # aHash/dHash/pHash + SSIM-proxy for canvas/chart diff
+    ├── test_scheduler/      # Value-density scheduler under time + cloud budget
+    ├── walkthrough_docs/    # AI step-by-step SOP / Confluence doc from recorded runs
+    ├── live_dashboard/      # Aggregated web UI: runs + flake + quarantine + locators
+    ├── ocr_assert/          # OCR-based text assertion for canvas / WebGL / image content
+    ├── email_render/        # Capture outbound mail (MailHog/Mailpit/EML) + multi-viewport screenshots
+    ├── backend_log_correlator/ # W3C trace_id → Loki/Elasticsearch/file log fetch into failure bundle
+    ├── websocket_assert/    # WebSocket frame recorder + count / payload / pubsub assertions
+    ├── console_error_budget/ # JS console / unhandled-rejection budget with ignore patterns
+    ├── chaos_hooks/         # Seeded chaos injection (offline / throttle / mid-flow reload)
+    ├── pr_risk_score/       # Fuse flake / impact / locator / coverage signals into 0-100 PR risk
+    ├── flag_matrix/         # Feature-flag combo matrix with constraints + minimal failing subset
+    ├── session_to_test/     # rrweb / generic session events → WR action JSON
+    ├── exploratory_ai/      # Agentic exploratory tester (observer/planner protocols + RandomPlanner)
+    ├── story_to_actions/    # LLM-driven user story / Figma frame → validated WR action JSON
+    ├── db_snapshot/         # Per-test DB savepoint/rollback with pluggable backend
+    ├── time_freezer/        # Inject Date/Date.now/performance.now patch via CDP for deterministic time tests
+    ├── persona_runner/      # Same suite × N personas (admin/free/enterprise) matrix
+    ├── token_leak_detector/ # Scan HAR / logs / responses for leaked JWTs, API keys, session tokens
+    ├── consent_audit/       # GDPR/CCPA cookie classification + pre-consent / post-reject violation detection
+    ├── pii_in_screenshot/   # OCR + PII regex (Luhn-validated card, SSN, TWID) scanner over screenshots
+    ├── pseudo_localization/ # ASCII → look-alike + expansion + brackets; detect hard-coded i18n leaks
+    ├── screen_reader_runner/ # Walk a11y tree to simulate NVDA/VoiceOver order + flag a11y violations
+    ├── forced_colors_mode/  # dark / reduced-motion / forced-colors / high-contrast matrix verification
+    ├── sse_assert/          # Server-Sent Events recorder + count/data/JSON-shape/strict-id assertions
+    ├── webrtc_assert/       # PeerConnection state / ICE / track / RTP stats assertions
+    ├── view_transitions/    # Instrumentation + duration/CLS/group assertions for View Transitions API
+    ├── test_dedup_ai/       # Structural + embedding-based semantic dedupe of action JSON files
+    ├── multimodal_qa/       # Send screenshot + question to vision LLM, parse pass/fail/notes envelope
+    ├── prompt_drift_monitor/ # Track LLM-feature output drift via embeddings + lexical anchors
+    ├── git_bisect_flake/    # Ledger-only or probe-driven bisect to find regression commit
+    ├── test_cost_estimator/ # Cloud-minute × rate-card × CO₂ estimate per suite/runner/test
+    ├── slack_digest/        # Render Slack Block-Kit / Teams card / plain-text test digest payload
+    ├── webtransport_assert/ # HTTP/3 WebTransport datagram + stream frame recorder + assertions
+    ├── indexed_db_explorer/ # IndexedDB snapshot harvest + store/key/index/record assertions
+    ├── file_system_access/  # Mock showOpenFilePicker/showSaveFilePicker + record writes
+    ├── notifications_audit/ # Notification.requestPermission timing + permission/spam policy checks
+    ├── mixed_content_audit/ # HTTP-on-HTTPS detection via HAR + console scanner
+    ├── clickjacking_audit/  # X-Frame-Options / frame-ancestors header check + iframe probe
+    ├── open_redirect_detector/ # Probe ?redirect=/?next= params with attacker-host payloads
+    ├── sri_verify/          # Subresource Integrity hash presence + correctness + crossorigin
+    ├── coop_coep_audit/     # crossOriginIsolated COOP/COEP + per-resource CORP/CORS check
+    ├── inp_tracker/         # Interaction to Next Paint instrumentation + p98 + budget
+    ├── hydration_check/     # SSR hydration mismatch detection (DOM diff + console markers)
+    ├── bundle_budget/       # Per-asset-kind byte budget from HAR + biggest-assets ranking
+    ├── third_party_budget/  # Third-party vendor classification + req/byte/blocking-ms budgets
+    ├── long_animation_frame/ # Long Animation Frame API listener + per-script attribution
+    ├── grpc_tester/         # gRPC stub call recorder + gRPC-Web framing/trailer helpers
+    ├── webhook_receiver/    # Threaded HTTP server for catching app's outbound webhooks
+    ├── idempotency_check/   # Run request twice + compare status/body/state/side-effects
+    ├── pagination_audit/    # Walk all pages, detect dups/gaps/cursor-loop/sort violations
+    ├── failure_narrator/    # LLM natural-language failure summary from failure_bundle
+    ├── repro_minimizer/     # Delta-debugging (ddmin) to shrink failing action list to minimum
+    ├── locator_hardener/    # Heuristic fragility score + LLM-suggested stable selectors
+    ├── test_categorizer/    # Auto-tag tests as smoke / regression / perf / a11y / data / api
+    ├── quarantine_age_report/ # Quarantine entries with age + fresh/lingering/stale/abandoned tiers
+    ├── test_debt_dashboard/ # Inventory of skip/xfail/TODO/_skip markers with age + CODEOWNERS
+    ├── sla_tracker/         # % suites finishing under SLA threshold, weekly/daily bucketing
+    ├── bug_repro_stability/ # Repeat probe N times, classify deterministic/flaky/non-reproducible
+    └── test_owners_map/     # CODEOWNERS parser + override layer + unowned-test audit
 ```
 
 ## Design Patterns & Architecture

je_web_runner/__init__.py

@@ -177,6 +177,205 @@
 from je_web_runner.utils.recorder.browser_recorder import save_recording as recorder_save_recording
 from je_web_runner.utils.recorder.browser_recorder import start_recording as recorder_start
 from je_web_runner.utils.recorder.browser_recorder import stop_recording as recorder_stop
+from je_web_runner.utils.chrome_profile.profile_manager import (
+    ChromeProfileError,
+    StealthFlags,
+    build_chrome_options as chrome_profile_build_options,
+    build_playwright_persistent_context,
+    build_stealth_chrome_driver,
+    chrome_profile_session,
+    cleanup_chrome_locks,
+    minimise_chrome_windows,
+    snapshot_chrome_profile,
+    sync_chrome_profile_back,
+)
+from je_web_runner.utils.failure_triage.triage import (
+    FailureTriageError,
+    TriageReport,
+    TriageSignals,
+    extract_signals_from_bundle,
+    render_markdown as triage_render_markdown,
+    save_report as triage_save_report,
+    triage_bundle,
+    triage_failure,
+)
+from je_web_runner.utils.flake_detector.detector import (
+    FlakeDetectorError,
+    FlakeScore,
+    QuarantineEntry,
+    QuarantineRegistry,
+    compute_flake_scores,
+    flaky_paths as flake_detector_flaky_paths,
+    flaky_quarantine,
+    quarantine_flaky,
+    quarantine_report_markdown,
+    release_if_stable,
+)
+from je_web_runner.utils.locator_health.health_report import (
+    FallbackHitTracker,
+    LocatorFinding,
+    LocatorHealthError,
+    LocatorHealthReport,
+    UpgradeSuggestion as LocatorUpgradeSuggestion,
+    apply_upgrades as locator_apply_upgrades,
+    build_health_report as locator_build_health_report,
+    fallback_hit_tracker,
+    render_health_markdown as locator_render_health_markdown,
+    save_health_report,
+    scan_action_file as locator_scan_action_file,
+    scan_project as locator_scan_project,
+    suggest_upgrade as locator_suggest_upgrade,
+    suggest_upgrades as locator_suggest_upgrades,
+)
+from je_web_runner.utils.device_cloud.real_device import (
+    CloudCredentials,
+    CloudSession,
+    DeviceCloudError,
+    RealDeviceCaps,
+    build_capabilities as device_cloud_build_capabilities,
+    connect_real_device,
+    fetch_session_info,
+    load_credentials as device_cloud_load_credentials,
+    session_summary_markdown,
+    update_session_status,
+)
+from je_web_runner.utils.otel_bridge.trace_bridge import (
+    TraceBridgeError,
+    TraceContext,
+    bridged_span_playwright,
+    bridged_span_selenium,
+    clear_headers_playwright,
+    clear_headers_selenium,
+    current_otel_context,
+    inject_headers_playwright,
+    inject_headers_selenium,
+    parse_traceparent,
+    random_trace_context,
+    trace_link,
+)
+from je_web_runner.utils.mutation_testing.mutator import (
+    Mutation,
+    MutationResult,
+    MutationScore,
+    MutationTestingError,
+    MutationType,
+    apply_mutation,
+    assert_min_score as mutation_assert_min_score,
+    generate_mutations,
+    render_mutation_markdown,
+    run_mutation_testing,
+    run_mutation_testing_on_file,
+)
+from je_web_runner.utils.otp_interceptor.interceptor import (
+    ImapProvider,
+    InMemoryProvider as OtpInMemoryProvider,
+    InterceptedMessage,
+    MailHogProvider,
+    MailpitProvider,
+    OtpInterceptError,
+    OtpProvider,
+    WebhookSmsProvider,
+    extract_otp_from_text,
+    wait_for_otp,
+)
+from je_web_runner.utils.download_verify.verifier import (
+    DownloadAssertion,
+    DownloadVerifyError,
+    assert_csv_columns,
+    assert_csv_row_count,
+    assert_download,
+    assert_file_sha256,
+    assert_json_matches_schema,
+    assert_pdf_contains,
+    assert_pdf_matches,
+    extract_pdf_text,
+    read_csv_rows,
+    read_excel_rows,
+    read_json_file,
+    sha256_of_file,
+    wait_for_download,
+)
+from je_web_runner.utils.test_auto_repair.repair import (
+    RepairPlan,
+    TestAutoRepairError,
+    apply_repair,
+    collect_git_diff,
+    propose_repair,
+    render_repair_markdown,
+    repair_from_bundle,
+)
+from je_web_runner.utils.edge_case_generator.generator import (
+    EdgeCase,
+    EdgeCaseCategory,
+    EdgeCaseGeneratorError,
+    EdgeCaseSuite,
+    generate_edge_cases,
+    generate_edge_cases_from_file,
+    render_suite_markdown as edge_case_render_markdown,
+    write_suite_to_dir as edge_case_write_suite,
+)
+from je_web_runner.utils.openapi_to_e2e.generator import (
+    GeneratedTest as OpenAPIGeneratedTest,
+    GenerationResult as OpenAPIGenerationResult,
+    OpenAPIGeneratorError,
+    generate_tests_from_file as openapi_generate_from_file,
+    generate_tests_from_spec as openapi_generate_from_spec,
+    load_spec as openapi_load_spec,
+    synthesize_example as openapi_synthesize_example,
+    write_tests_to_dir as openapi_write_tests,
+)
+from je_web_runner.utils.cross_tab_sync.sync_assertions import (
+    CrossTabSyncError,
+    PropagationResult,
+    assert_state_propagates,
+    broadcast_message,
+    collect_broadcast_messages,
+    get_storage_value,
+    install_broadcast_recorder,
+    post_message_to_page,
+    set_storage_value,
+    wait_for_broadcast,
+    wait_for_storage,
+)
+from je_web_runner.utils.visual_ai.perceptual import (
+    HashResult as VisualHashResult,
+    SimilarityResult as VisualSimilarityResult,
+    VisualAIError,
+    assert_visual_similar,
+    average_hash as visual_average_hash,
+    compare_images as visual_compare_images,
+    difference_hash as visual_difference_hash,
+    hamming_distance as visual_hamming_distance,
+    hash_similarity as visual_hash_similarity,
+    perceptual_hash as visual_perceptual_hash,
+)
+from je_web_runner.utils.test_scheduler.scheduler import (
+    Schedule,
+    TestCandidate,
+    TestSchedulerError,
+    build_candidates_from_ledger,
+    render_schedule_markdown,
+    schedule_tests,
+    value_density as scheduler_value_density,
+    value_of as scheduler_value_of,
+)
+from je_web_runner.utils.walkthrough_docs.generator import (
+    Walkthrough,
+    WalkthroughError,
+    WalkthroughStep,
+    build_walkthrough,
+    collect_steps as walkthrough_collect_steps,
+    narrate_steps as walkthrough_narrate_steps,
+    render_confluence as walkthrough_render_confluence,
+    render_markdown as walkthrough_render_markdown,
+    save_walkthrough,
+)
+from je_web_runner.utils.live_dashboard.server import (
+    DashboardConfig,
+    DashboardServer,
+    LiveDashboardError,
+    build_summary as dashboard_build_summary,
+)
 __all__ = [
     "web_element_wrapper", "set_webdriver_options_argument",
     "webdriver_wrapper_instance", "get_webdriver_manager",
@@ -236,5 +435,95 @@
     "pw_wait_for_timeout", "pw_wait_for_url",
     "pw_set_viewport_size", "pw_viewport_size",
     "pw_mouse_click", "pw_mouse_move", "pw_mouse_down", "pw_mouse_up",
-    "pw_keyboard_press", "pw_keyboard_type", "pw_keyboard_down", "pw_keyboard_up"
+    "pw_keyboard_press", "pw_keyboard_type", "pw_keyboard_down", "pw_keyboard_up",
+    # Phase 1: chrome_profile
+    "ChromeProfileError", "StealthFlags",
+    "chrome_profile_build_options", "build_playwright_persistent_context",
+    "build_stealth_chrome_driver", "chrome_profile_session",
+    "cleanup_chrome_locks", "minimise_chrome_windows",
+    "snapshot_chrome_profile", "sync_chrome_profile_back",
+    # Phase 2: failure_triage
+    "FailureTriageError", "TriageReport", "TriageSignals",
+    "extract_signals_from_bundle", "triage_render_markdown",
+    "triage_save_report", "triage_bundle", "triage_failure",
+    # Phase 3: flake_detector
+    "FlakeDetectorError", "FlakeScore", "QuarantineEntry", "QuarantineRegistry",
+    "compute_flake_scores", "flake_detector_flaky_paths", "flaky_quarantine",
+    "quarantine_flaky", "quarantine_report_markdown", "release_if_stable",
+    # Phase 4: locator_health
+    "FallbackHitTracker", "LocatorFinding", "LocatorHealthError",
+    "LocatorHealthReport", "LocatorUpgradeSuggestion",
+    "locator_apply_upgrades", "locator_build_health_report",
+    "fallback_hit_tracker", "locator_render_health_markdown",
+    "save_health_report", "locator_scan_action_file", "locator_scan_project",
+    "locator_suggest_upgrade", "locator_suggest_upgrades",
+    # Phase 5: device_cloud
+    "CloudCredentials", "CloudSession", "DeviceCloudError", "RealDeviceCaps",
+    "device_cloud_build_capabilities", "connect_real_device",
+    "fetch_session_info", "device_cloud_load_credentials",
+    "session_summary_markdown", "update_session_status",
+    # Phase 6: otel_bridge
+    "TraceBridgeError", "TraceContext",
+    "bridged_span_playwright", "bridged_span_selenium",
+    "clear_headers_playwright", "clear_headers_selenium",
+    "current_otel_context", "inject_headers_playwright",
+    "inject_headers_selenium", "parse_traceparent",
+    "random_trace_context", "trace_link",
+    # Phase 7: mutation_testing
+    "Mutation", "MutationResult", "MutationScore", "MutationTestingError",
+    "MutationType", "apply_mutation", "mutation_assert_min_score",
+    "generate_mutations", "render_mutation_markdown",
+    "run_mutation_testing", "run_mutation_testing_on_file",
+    # Phase 8: otp_interceptor
+    "ImapProvider", "OtpInMemoryProvider", "InterceptedMessage",
+    "MailHogProvider", "MailpitProvider", "OtpInterceptError",
+    "OtpProvider", "WebhookSmsProvider",
+    "extract_otp_from_text", "wait_for_otp",
+    # Phase 9: download_verify
+    "DownloadAssertion", "DownloadVerifyError",
+    "assert_csv_columns", "assert_csv_row_count", "assert_download",
+    "assert_file_sha256", "assert_json_matches_schema",
+    "assert_pdf_contains", "assert_pdf_matches",
+    "extract_pdf_text", "read_csv_rows", "read_excel_rows",
+    "read_json_file", "sha256_of_file", "wait_for_download",
+    # Phase 11: test_auto_repair
+    "RepairPlan", "TestAutoRepairError",
+    "apply_repair", "collect_git_diff", "propose_repair",
+    "render_repair_markdown", "repair_from_bundle",
+    # Phase 12: edge_case_generator
+    "EdgeCase", "EdgeCaseCategory", "EdgeCaseGeneratorError",
+    "EdgeCaseSuite",
+    "generate_edge_cases", "generate_edge_cases_from_file",
+    "edge_case_render_markdown", "edge_case_write_suite",
+    # Phase 13: openapi_to_e2e
+    "OpenAPIGeneratedTest", "OpenAPIGenerationResult",
+    "OpenAPIGeneratorError",
+    "openapi_generate_from_file", "openapi_generate_from_spec",
+    "openapi_load_spec", "openapi_synthesize_example", "openapi_write_tests",
+    # Phase 14: cross_tab_sync
+    "CrossTabSyncError", "PropagationResult",
+    "assert_state_propagates", "broadcast_message",
+    "collect_broadcast_messages", "get_storage_value",
+    "install_broadcast_recorder", "post_message_to_page",
+    "set_storage_value", "wait_for_broadcast", "wait_for_storage",
+    # Phase 15: visual_ai
+    "VisualHashResult", "VisualSimilarityResult", "VisualAIError",
+    "assert_visual_similar",
+    "visual_average_hash", "visual_compare_images",
+    "visual_difference_hash", "visual_hamming_distance",
+    "visual_hash_similarity", "visual_perceptual_hash",
+    # Phase 16: test_scheduler
+    "Schedule", "TestCandidate", "TestSchedulerError",
+    "build_candidates_from_ledger", "render_schedule_markdown",
+    "schedule_tests",
+    "scheduler_value_density", "scheduler_value_of",
+    # Phase 17: walkthrough_docs
+    "Walkthrough", "WalkthroughError", "WalkthroughStep",
+    "build_walkthrough",
+    "walkthrough_collect_steps", "walkthrough_narrate_steps",
+    "walkthrough_render_confluence", "walkthrough_render_markdown",
+    "save_walkthrough",
+    # Phase 19: live_dashboard
+    "DashboardConfig", "DashboardServer", "LiveDashboardError",
+    "dashboard_build_summary",
 ]