@sprid/scout 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 0.1.2 - 2026-10-23
+
+- `job_results` refuses a run id that is not one scout issued. A crafted id could read any JSON file on the machine.
+
+## 0.1.1 - 2026-10-19
+
+- Remove automatic likes from TikTok discovery. Research no longer clicks like controls while collecting accounts.
+- Clarify local storage, requests to research platforms and optional uploads to Sprid.
+- Report the installed package version in the MCP server handshake.

package/README.md

@@ -5,9 +5,10 @@ driving your own Chrome. It finds accounts posting photo slideshows about your
 keywords, measures each one, and files what it learns into a library on your
 machine.
 
-Nothing leaves this computer unless you ask for it. There is no account and no
-server behind it; the Sprid plugin's `scout` skill teaches your agent how to use
-it well.
+Research results are saved locally. Searches and page visits go to the platforms
+you research through Chrome. Sending findings to Sprid is optional and requires
+your instruction. Discovery does not like posts, follow accounts or send messages.
+The Sprid plugin's `scout` skill guides the research.
 
 ## What it does
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sprid/scout",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Local MCP server that researches a niche over your own Chrome: the accounts winning it, and the ads running in it.",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://sprid.studio/agents",
@@ -16,6 +16,7 @@
   "files": [
     "src",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "engines": {

package/src/discover.js

@@ -17,7 +17,6 @@ const FIRST_ROUND_CANDIDATES_PER_ACCOUNT = 4;
 const MIN_CANDIDATE_POOL = 10;
 const MAX_CANDIDATE_POOL = 500;
 const BOT_THRESHOLD = 3;
-const LIKE_EVERY = 6;
 
 function clamp(value, lo, hi) {
   return Math.max(lo, Math.min(hi, value));
@@ -33,47 +32,16 @@ function nextPool(missing, passRate) {
   return clamp(needed, MIN_CANDIDATE_POOL, MAX_CANDIDATE_POOL);
 }
 
-async function likePost(context, username, postId, log) {
-  log("  Liking a post to train the algorithm...");
-  let page = null;
-  try {
-    page = await context.newPage();
-    await page.goto(`https://www.tiktok.com/@${username}/photo/${postId}`, {
-      waitUntil: "domcontentloaded",
-      timeout: 15_000,
-    });
-    await page.waitForTimeout(2000);
-    for (const selector of [
-      '[data-e2e="like-icon"]',
-      '[data-e2e="browse-like-icon"]',
-      'button[aria-label*="ike"]',
-    ]) {
-      try {
-        const button = page.locator(selector).first();
-        if (await button.isVisible({ timeout: 2000 })) {
-          await button.click();
-          await page.waitForTimeout(1000);
-          break;
-        }
-      } catch {}
-    }
-  } catch {
-  } finally {
-    await page?.close().catch(() => {});
-  }
-}
-
 /**
  * Phase 1. Types each keyword into TikTok's own search and reads the results
  * the page fetches for itself, Top tab first and Photo behind it when Top runs
  * thin. Keywords are walked in order and spent only as far as needed.
  */
 async function searchViaFeed({ keywords, cursor, maxPool, alreadyProcessed, session, log, gate, challenge }) {
-  const { context, newPage } = session;
+  const { newPage } = session;
   const searchPage = await newPage();
   const candidates = {};
   const hashtagFreq = {};
-  const liked = new Set();
   let consumed = 0;
 
   async function sweep(keyword, tab) {
@@ -157,14 +125,6 @@ async function searchViaFeed({ keywords, cursor, maxPool, alreadyProcessed, sess
         }
       }
 
-      // Tell the algorithm what this session is into, occasionally.
-      const fresh = slideshowPosts.filter((p) => !liked.has(p.post_id));
-      if (fresh.length && liked.size < Math.ceil(scroll / LIKE_EVERY) + 1) {
-        const pick = fresh[0];
-        liked.add(pick.post_id);
-        await likePost(context, pick.username, pick.post_id, log);
-      }
-
       if (Object.keys(candidates).length >= maxPool) break;
       silentScrolls = Object.keys(candidates).length === prev ? silentScrolls + 1 : 0;
       if (silentScrolls >= 3) break;

package/src/server.js

@@ -156,7 +156,7 @@ function persistDiscovery(job) {
 
 // ---------------------------------------------------------------------------
 
-const mcp = new McpServer({ name: NAME, version: "0.1.0" }, { instructions: INSTRUCTIONS });
+const mcp = new McpServer({ name: NAME, version: require("../package.json").version }, { instructions: INSTRUCTIONS });
 
 mcp.registerTool(
   "status",

package/src/store.js

@@ -23,16 +23,25 @@ function readJson(file, fallback) {
   }
 }
 
+// A run id is `${tool}-${8 hex}` (jobs.js). It arrives from a tool argument,
+// so anything else is refused before it reaches a path: `../` in it read any
+// JSON file on the machine.
+const RUN_ID = /^[a-z]+-[0-9a-f]{8}$/;
+
 function runFile(runId) {
+  if (!RUN_ID.test(String(runId))) return null;
   return path.join(RUNS_DIR, `${runId}.json`);
 }
 
 function saveRun(run) {
-  writeAtomic(runFile(run.id), run);
+  const file = runFile(run.id);
+  if (!file) throw new Error(`Invalid run id: ${run.id}`);
+  writeAtomic(file, run);
 }
 
 function loadRun(runId) {
-  return readJson(runFile(runId), null);
+  const file = runFile(runId);
+  return file ? readJson(file, null) : null;
 }
 
 function listRuns() {