v1.90.0.0 feat: make browser cookie imports explicit and safe (#2964)

* fix(browse): prepare reliable cookie import wave for validation

* ci: sequence quality and behavior for validation branch

* fix(browse): isolate Windows qualification and preserve native diagnostics

* test(browse): cover cookie workflow quality and isolate Windows user paths

* test(browse): trace native member startup and initialize fresh folders

* fix(browse): keep Windows member stdin alive through EOF

* fix(browse): latch native timeouts and compare contained Edge startup

* test(browse): verify native version metadata and actual Windows argv

* test(browse): qualify Dia import on isolated macOS CI

* fix(browse): require picker origin for session mutations

* fix(browse): bound credential reads through stream completion

* test(browse): inspect owned Windows process arguments natively

* test(evals): preserve passing coverage during cookie repair reruns

* test(browse): isolate Dia qualification in a fresh macOS account

* test(browse): pass bounded integer timeouts to native Mac probes

* test(browse): distinguish Windows profile initialization from containment

* test(browse): await descendant pipe readiness before parent exit

* test(browse): initialize and restore isolated macOS Keychain state

* test(browse): initialize Windows fixture folders before qualification

* test(ci): pin the same Node runtime across Windows checks

* test(browse): distinguish native macOS browser preflight stages

* test(browse): isolate Windows descendant console lifetime

* test(browse): preserve native receipts and identify fixture lock holders

* test(browse): prepare dependency resolution before native Mac worker startup

* test(ci): include lock and close checks in native diagnostics

* test(browse): preserve native owner probe stages and subprocess deadlines

* fix(browse): classify Chromium profile-in-use exit precisely

* test(browse): retain Mac qualification evidence through cleanup failures

* test(browse): bound Mac fixture paths and retire its owned user domain

* test(browse): accept vanished fixture entries without weakening cleanup

* test(browse): identify probe-created macOS user domains safely

* test(browse): observe Mac user domains without targeting them first

* test(browse): use passive fresh-user ownership throughout Mac qualification

* test(browse): distinguish profile and registered-home Keychain lookups

* test(browse): qualify Dia under one registered account home

* test(browse): identify Dia startup and owned process-group failures

* test(browse): classify bounded Dia startup diagnostics without leaking output

* fix(test): preserve native Mac sandboxing and reap owned browser children

* fix(browse): preserve Chromium sandboxing for native profile imports

* test(browse): inspect signed Mach-O architecture without launching Xcode tools

* test(browse): sample pending Dia startup and reap on all cleanup paths

* test(browse): compare protected Dia launches in fresh Bun and Node accounts

* test(browse): inspect isolated Mac GUI readiness without browser access

* v1.90.0.0 fix: bind cookie picker actions to their document

* test: validate cookie guards and fit nested launch fixtures

* ci: configure the bundled Chromium sandbox helper

* fix(browse): classify Playwright authentication timeouts

* test: retain bounded Windows lifecycle diagnostics

* test(cso): reuse bounded NTFS precision candidates

* test(review): handle explicit preservation choices safely

* test(browse): remove owned fixture directories with explicit primitives

* test(review): distinguish descriptive reuse from edit commitments

* test: admit only the approved unscored cookie workflow refusal

* test: keep the Office Hours judge mock export-complete

* fix: keep dependency-free CI planners independent of the model SDK

* test: observe the exact holder after a native fixture unlink failure

* fix: start seeded PTY observations at owned readiness

* test: acquire identity-bound Windows deletion admission before profile resets

* test: preserve qualified Git index bits without authorizing mutations

scripts/eval-summary.ts

@@ -8,7 +8,7 @@
 
 import * as fs from 'fs';
 import type { EvalResult } from '../test/helpers/eval-store';
-import { getProjectEvalDir, listEvalJsonFiles } from '../test/helpers/eval-store';
+import { evalEntryOutcome, getProjectEvalDir, listEvalJsonFiles } from '../test/helpers/eval-store';
 
 const EVAL_DIR = getProjectEvalDir();
 
@@ -77,11 +77,21 @@ const avgDetection = detectionRates.length > 0
 
 // Flaky tests (passed in some runs, failed in others)
 const testResults = new Map<string, boolean[]>();
+const manualAccepted: Array<{ name: string; approvedBy: string; approvalUrl: string }> = [];
 for (const r of results) {
+  const final = new Map(r.tests.map(t => [t.name, t]));
+  const manuallyAcceptedNames = new Set([...final.values()].filter(t => evalEntryOutcome(t) === 'manual-review').map(t => t.name));
+  for (const t of final.values()) {
+    if (evalEntryOutcome(t) === 'manual-review') manualAccepted.push({ name: t.name,
+      approvedBy: t.manual_review!.approval.approved_by, approvalUrl: t.manual_review!.approval.approval_url });
+  }
   for (const t of r.tests) {
+    if (manuallyAcceptedNames.has(t.name)) continue;
     const key = `${r.tier}:${t.name}`;
+    const outcome = evalEntryOutcome(t);
+    if (outcome === 'manual-review') continue;
     if (!testResults.has(key)) testResults.set(key, []);
-    testResults.get(key)!.push(t.passed);
+    testResults.get(key)!.push(outcome === 'passed');
   }
 }
 const flakyTests: string[] = [];
@@ -119,6 +129,10 @@ console.log('Eval Summary');
 console.log('═'.repeat(70));
 console.log(`  Total runs:        ${results.length} (${e2eRuns.length} e2e, ${judgeRuns.length} llm-judge)`);
 console.log(`  Total spend:       $${totalCost.toFixed(2)}`);
+if (manualAccepted.length) {
+  console.log(`  Manual accepted:   ${manualAccepted.length} unscored provider refusal(s)`);
+  for (const entry of manualAccepted) console.log(`    ${entry.name}: approved by ${entry.approvedBy} (${entry.approvalUrl})`);
+}
 console.log(`  Avg cost/e2e:      $${avgE2ECost.toFixed(2)}`);
 console.log(`  Avg cost/judge:    $${avgJudgeCost.toFixed(2)}`);
 if (avgE2EDuration > 0) {