scenescout 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # scenescout
 
+## 1.4.0
+
+### Minor Changes
+
+- 01fe452: The engine now notices when a value it typed comes back as markup. Any markup-shaped value the agent types — `<script>…</script>`, `<img src=x onerror=…>`, a `<b>` — is remembered by shape, and every page seen afterwards is checked for an element of that shape. When one is found, a `dom_injection` violation (severity high) names the field it was typed into, the page it was typed on, the page it rendered on and the element it became: whoever opens that page runs the input, which is a stored or reflected XSS. The oracle never chooses what to type; the method asks for markup in the fuzzing pass, and the rest is the agent's judgment.
+
+### Patch Changes
+
+- 2deca2a: Two findings that name the same endpoint no longer merge unless both name a failure status for it. A double submit and an accepted bad value can both mention `POST /api/orders` and are two bugs; the second one filed used to be absorbed into the first without a trace.
+- 4e10197: The live view's header keeps its two buttons together when it wraps on a narrow screen, numbers that tick every second (badges, feed times, the session counts) use tabular numerals so they no longer jitter, the feed's journey groups are marked by their tint with a hairline rather than a stripe, and the scrolling panels and text selection take the page's own palette.
+- 978022a: Every record a session creates is now named in the result of the action that created it (`created: /api/things id=44`), including the second and later ones on an endpoint. The state-changing-request notice reports each endpoint once per session, which in safe-write mode hid every creation after the first, so the agent could not tell from the result that it had just made one.
+- dd8927a: `scout_run_plan` now prints a type step's note about the field (such as "replaced existing content") on that step's own line. It used to appear under the previous step, so a reader concluded the wrong field was prefilled.
+
 ## 1.3.0
 
 ### Minor Changes

package/README.md

@@ -506,6 +506,7 @@ src/
     probes.ts       in-page scroll + overlay + focus probes (needs a browser too)
     fingerprint.ts  route + element-set identity (state hashing)
     oracles.ts      console/page/network/HTTP error detection
+    injection.ts    the DOM-injection oracle's rules (what to watch for, how to find it)
     policy.ts       the write-policy safety net
     ownership.ts    safe-write: which records did this run create?
     uploads.ts      disk uploads, fenced to the project by real path
@@ -545,7 +546,7 @@ Working on SceneScout itself is the only reason to clone it:
 git clone https://github.com/brunoboto96/SceneScout.git scenescout && cd scenescout
 npm install        # installs dependencies and builds
 npm run setup      # same as `scenescout install`, but registers THIS checkout (the skill is linked, so edits are live)
-npm test           # build + 12 suites: scan, oracle, policy, fixture, dispatch, design,
+npm test           # build + 14 suites: scan, oracle, policy, fixture, dispatch, design,
                    #                     contract, memory, install, hygiene, smoke, mcp-check
 npm run demo       # regenerate examples/ from the demo app
 ```
@@ -566,7 +567,7 @@ Found a way past the write policy, or another security problem? Please report it
 - **Structured render-state, not pixels.** Element lists with geometry; screenshots reserved for pixel-native residue (canvas, rendering glitches). Images that failed to load are reported from the DOM, including ones whose URL answered 200 with something that is not an image.
 - **Diff snapshots with stable refs.** Re-snapshots return only what changed (10.7 kB → 0.7 kB on a 130-element page); old refs stay valid.
 - **Geometry oracles.** Overlap and off-screen defects computed from layout boxes.
-- **Oracles after every action.** Console errors, page errors, failed requests, HTTP 4xx/5xx drained into every tool result.
+- **Oracles after every action.** Console errors, page errors, failed requests, HTTP 4xx/5xx drained into every tool result — and DOM injection: a markup-shaped value the agent typed that later renders as an element on any page (stored or reflected XSS).
 - **Multi-role, genuinely concurrent.** Commands to *different* sessions run in parallel; safe-write ownership is shared, so role A can create what role B approves. The report renders a role capability matrix.
 - **Task ease, not just correctness.** `scout_journey` measures interaction cost, distinct screens, path, and backtracks.
 - **Design audit with page scores.** Two tiers (⚠ measurable defects / → craft suggestions incl. AI-slop tells), per-page 0–100 score persisted per route, plus an automatic overlay/modal probe on every snapshot. Shared shell scored once, separately.

package/dist/cli.js

@@ -17,7 +17,7 @@ import { APPROX_DISK_MB, BROWSER_ENGINES, browserPresence, defaultAttachNote, de
 import { CLIENT_LABELS, firstMessageHint, manualFor, parseClients, registerWithClient, vscodeBinary } from "./clients.js";
 import { CLI_NAME, diagnose, ensureCommand, findOnUserPath, installSkill, isEphemeralRoot, launchCommand, manualRegisterCommand, planCommand, registerMcp, resolveClaudeDir, spawnRunner, } from "./installer.js";
 import { LEGACY_MEMORY_DIRNAME, MEMORY_DIRNAME } from "./engine/memory.js";
-import { localClock, formatSessionLine, LIVE_TOKEN_FILE, watchTarget, wholeSessions } from "./engine/live.js";
+import { formatStatus, localClock, LIVE_TOKEN_FILE, watchTarget } from "./engine/live.js";
 import { formatScan, scanProject } from "./scan.js";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const packageRoot = path.resolve(here, "..");
@@ -98,28 +98,8 @@ function status(projectPath) {
         return;
     }
     const alive = pidAlive(st.pid);
-    const age = st.at ? Math.round((Date.now() - new Date(st.at).getTime()) / 1000) : null;
-    console.log(`Engine pid ${st.pid ?? "?"} — ${alive ? "ALIVE" : "not running (stale status)"}`);
-    console.log(`${st.phase === "running" ? "⏳ running" : "· idle after"}: ${st.tool ?? "?"}${age !== null ? ` (as of ${age}s ago)` : ""}`);
-    // The file is written by another process and can be caught mid-write, so
-    // only entries whole enough to describe are described.
-    const sessions = wholeSessions(st.detail);
-    if (sessions.length > 0) {
-        // One line per session. The single "Session:" line below it is all an
-        // engine from before the live view can offer.
-        console.log(`Sessions (${sessions.length}):`);
-        for (const entry of sessions)
-            console.log(`  ${formatSessionLine(entry, Date.now())}`);
-        if (alive && st.live?.port)
-            console.log("Live view: scenescout watch");
-        if (alive && st.live?.error)
-            console.log(`Live view unavailable: ${st.live.error}`);
-    }
-    else {
-        console.log(`Session: ${st.session ?? "?"} (${st.role ?? "?"})${st.sessions && st.sessions.length > 1 ? ` · all sessions: ${st.sessions.join(", ")}` : ""}`);
-        if (st.url)
-            console.log(`URL: ${st.url}`);
-    }
+    for (const line of formatStatus(st, alive, Date.now()))
+        console.log(line);
     // Recent actions from the newest session log — the "what has it been doing" trail.
     const logs = fs.existsSync(dir)
         ? fs

package/dist/engine/browser.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { elementKey, fingerprintState, isNonPageRoute, normalizePath } from "./fingerprint.js";
 import { AUTH_LOSS_PREFIX, JOURNEY_END, JOURNEY_START, MemoryStore } from "./memory.js";
+import { describeInjection, newInjections, probeQueries, probeScript, probeShape, rememberProbe } from "./injection.js";
 import { AuthLossTracker } from "./authloss.js";
 import { COLLECT_INTERACTABLES_SCRIPT, VISIBLE_SRC, geometryIssues, BROKEN_IMAGES_SCRIPT, brokenImageIssues, } from "./collector.js";
 import { OracleMonitor, formatViolations } from "./oracles.js";
@@ -184,6 +185,20 @@ export class BrowserEngine {
         return this.memory?.createdResources ?? this.localCreatedResources;
     }
     localCreatedResources = [];
+    /** Creations not yet named in a tool result. Unlike the once-per-session mutation notice, every one is reported. */
+    newlyCreated = [];
+    /**
+     * Name every record created since the last result. The mutation notice
+     * reports each endpoint once per session so a read-only run is not flooded;
+     * in safe-write that hid every creation after the first on an endpoint,
+     * so the agent could not tell from the result that it had just made one.
+     */
+    drainCreated() {
+        if (this.newlyCreated.length === 0)
+            return "";
+        const list = this.newlyCreated.splice(0);
+        return `\n(created: ${list.join(", ")} — this session may edit or delete ${list.length === 1 ? "it" : "them"})`;
+    }
     /** Design audits run this session — the report gate requires at least one. */
     designAuditCount = 0;
     /** Active task-efficiency measurement (scout_journey), if any. */
@@ -248,6 +263,54 @@ export class BrowserEngine {
      * allowed POST /items that shares its prefix.
      */
     abortedByPolicy = new WeakSet();
+    /** Markup-shaped values this session typed, so every later page can be checked for them rendering as elements. */
+    probes = [];
+    /** Injections already reported, by payload and route, so a page is not reported on every snapshot. */
+    injectionsReported = new Set();
+    /**
+     * Remember a typed value when it holds an element worth watching for. What
+     * to type is the agent's choice; this only watches for the outcome. The
+     * page's current count of such elements is the baseline: shared chrome that
+     * happens to look like the payload is not an injection.
+     */
+    async noteProbe(value, field) {
+        const shape = probeShape(value);
+        if (!shape || this.probes.some((p) => p.payload === shape.payload))
+            return;
+        const page = this.page;
+        let baseline = 0;
+        if (page && !page.isClosed()) {
+            try {
+                baseline = (await page.evaluate(probeScript([shape]))).length;
+            }
+            catch {
+                // A page mid-navigation: no baseline, so a coincidence on this page would be reported. Rare, and visible.
+            }
+        }
+        this.probes = rememberProbe(this.probes, { ...shape, field, typedOn: page?.url() ?? "", baseline });
+    }
+    /**
+     * The DOM-injection oracle: has anything this session typed come back as an
+     * element on the current page? Runs wherever violations are drained, so the
+     * finding reaches the agent in the result of the action that revealed it.
+     */
+    async scanForInjections() {
+        const page = this.page;
+        if (!page || page.isClosed() || this.probes.length === 0)
+            return;
+        const url = page.url();
+        let hits;
+        try {
+            hits = (await page.evaluate(probeScript(probeQueries(this.probes))));
+        }
+        catch {
+            // A page mid-navigation has no DOM to ask; the next drain looks again.
+            return;
+        }
+        for (const found of newInjections(this.probes, hits, url, this.injectionsReported)) {
+            this.oracles.noteInjection(describeInjection(found.probe, url, found.outer), url);
+        }
+    }
     /** Raw mutation sigs of the most recent action (pre-dedup) — double-submit detection. */
     lastActionMutationSigs = [];
     /** Write-policy blocks drained by the last action — counted, so an action can know a request fired even when the policy stopped it. */
@@ -641,6 +704,7 @@ export class BrowserEngine {
         const isNew = memory.visitState(fp, url, route, elements.map((el) => el.key));
         memory.recordRoleAccess(this.role, route, "reached");
         this.logAction({ action: "snapshot", url, result: fp });
+        await this.scanForInjections();
         const line = (el) => {
             const dup = el.key.match(/~(\d+)$/);
             const flags = [
@@ -798,8 +862,9 @@ export class BrowserEngine {
                 formatViolations(this.oracles.drain()));
         }
         this.logAction({ action, target, url });
+        await this.scanForInjections();
         const violations = this.oracles.drain();
-        const mutations = this.drainMutations() + this.drainBlocked();
+        const mutations = this.drainMutations() + this.drainBlocked() + this.drainCreated();
         const navigated = this.snapshotUrl !== "" && url !== this.snapshotUrl;
         if (navigated) {
             // Refs point into the previous page's DOM; invalidate so a stale ref
@@ -847,6 +912,7 @@ export class BrowserEngine {
             const desc = `${verdict.collection} id=${id}`;
             if (!this.createdResources.includes(desc)) {
                 this.createdResources.push(desc);
+                this.newlyCreated.push(desc);
                 this.logAction({ action: "created-resource", target: desc, url: this.page?.url() ?? "" });
             }
         }
@@ -1081,6 +1147,8 @@ export class BrowserEngine {
         if (refusal)
             return refusal;
         const locator = page.locator(`xpath=${el.xpath}`);
+        // Before the fill: a page that reflects input as it is typed already holds the element afterwards.
+        await this.noteProbe(text, `${el.role} "${el.name}"`);
         const fillNote = await this.fillOrAppend(locator, text, replace);
         if (pressEnter) {
             // Enter inside a form submits it — check the form's submit target, or
@@ -1614,6 +1682,7 @@ export class BrowserEngine {
             if (typeof status === "number" && status >= 400)
                 memory.markAttempted(requestedRoute, `status:${status}`, this.role);
             this.logAction({ action: "crawl", target: path, url: finalUrl });
+            await this.scanForInjections();
             const violations = this.oracles.drain();
             const deadEnd = elements.length === 0;
             const unnamed = elements.filter((el) => !el.name).length;
@@ -1686,6 +1755,9 @@ export class BrowserEngine {
             let preTestid = null;
             let preLabel = "";
             let forcedClick = false;
+            // What a type step has to say about the field it typed into; it goes on
+            // the step's own line, so it cannot read as the previous step's.
+            let note = "";
             let preState = null;
             try {
                 if (step.action === "navigate") {
@@ -1755,9 +1827,9 @@ export class BrowserEngine {
                             : `   hover revealed nothing within ${HOVER_REVEAL_WINDOW_MS / 1000}s`);
                     }
                     else if (step.action === "type") {
+                        await this.noteProbe(step.value ?? "", step.target ?? "the field");
                         const fillNote = await this.fillOrAppend(loc, step.value ?? "", step.replace ?? false);
-                        if (fillNote)
-                            transcript.push(`  ${fillNote.trim()}`);
+                        note = fillNote;
                         if (step.pressEnter) {
                             if (this.readOnly) {
                                 const submit = loc.locator("xpath=ancestor::form[1]").locator('[type="submit"], button:not([type="button"]):not([type="reset"])').first();
@@ -1826,19 +1898,20 @@ export class BrowserEngine {
                         /* coverage bookkeeping must never fail the plan */
                     }
                 }
+                await this.scanForInjections();
                 const violations = this.oracles.drain();
-                const mutations = this.drainMutations() + this.drainBlocked();
+                const mutations = this.drainMutations() + this.drainBlocked() + this.drainCreated();
                 // Abort only on NEW violations: a known-failing endpoint repeating on
                 // every navigation must not make every plan abort at step 1.
                 if (violations.some((v) => !v.repeat)) {
-                    transcript.push(`${desc} → OK, but oracle fired:${formatViolations(violations)}${mutations}`);
+                    transcript.push(`${desc} → OK${note}, but oracle fired:${formatViolations(violations)}${mutations}`);
                     transcript.push(`PLAN ABORTED at step ${i + 1} — investigate before continuing.`);
                     break;
                 }
                 const forcedNote = forcedClick
                     ? " (forced — the strict click timed out on this element's hit-test/stability check but a forced click still landed; something may render on top of it or delegate via a label, cross-check GEOMETRY overlaps before calling it a bug)"
                     : "";
-                transcript.push(`${desc} → OK (${page.url()})${mutations}${forcedNote}`);
+                transcript.push(`${desc} → OK (${page.url()})${note}${mutations}${forcedNote}`);
             }
             catch (err) {
                 const fullMsg = err instanceof Error ? err.message : String(err);

package/dist/engine/injection.js

@@ -0,0 +1,162 @@
+/**
+ * The DOM-injection oracle's rules: what a typed value has to look like to be
+ * worth watching for, how to look for it on a later page, and how to describe
+ * it when it turns up as an element.
+ *
+ * The engine never tells the agent what to type. It only remembers the shape
+ * of any markup-shaped value the agent chose to type, and checks every page it
+ * sees afterwards for an element of that shape. A value that comes back as an
+ * element rather than text means whoever opens that page runs the input:
+ * stored or reflected injection (XSS).
+ *
+ * An element counts as the typed one only when it carries exactly the
+ * payload's attributes (an app's own link has extras such as a testid; an
+ * injected one has just what was typed) and, when the payload had text, that
+ * text. A payload with neither is not watched: `<script>` or `<br>` on their
+ * own would match any page. No browser is needed for these rules, so they are
+ * table-tested; the one DOM query lives in browser.ts.
+ */
+import { normalizePath } from "./fingerprint.js";
+/** Most probes a session keeps. Every page is checked for each in one query, so the list can be generous: a fuzzing pass types many. */
+export const MAX_PROBES = 60;
+/** Text is compared on this many characters, on both sides, so a long fuzz value still matches its element. */
+export const INJECTION_TEXT_MAX = 200;
+/** Most matching elements reported per probe per page. */
+export const MAX_HITS = 20;
+const OPEN_RE = /<([a-zA-Z][a-zA-Z0-9-]*)/;
+// One attribute at a time, anchored where the last one ended: a slash between
+// attributes is the same as a space to a browser (`<svg/onload=…>`). Each
+// match consumes at least one character, so a hostile value cannot make the
+// parse backtrack.
+const ATTR_RE = /[\s/]*([^\s=>/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/y;
+const CLOSE_RE = /[\s/]*>/y;
+/** Values longer than this are cut before parsing; no payload needs more. */
+const MAX_VALUE_LENGTH = 2000;
+/** Attribute names that can go into a selector as they are. Anything else is dropped rather than escaped. */
+const ATTR_NAME_RE = /^[A-Za-z_][-A-Za-z0-9_]*$/;
+function cssValue(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\a ").replace(/\r/g, "\\d ");
+}
+function routeOf(url) {
+    try {
+        return normalizePath(new URL(url).pathname);
+    }
+    catch {
+        return url || "?";
+    }
+}
+/**
+ * The shape for a typed value, or null when the value holds no element worth
+ * watching: plain text, an email, a URL, a stray `<`, and an element with
+ * nothing to tell it apart by (`<script>`, `<br>`) are none of the oracle's
+ * business.
+ */
+export function probeShape(raw) {
+    const value = raw.slice(0, MAX_VALUE_LENGTH);
+    const open = OPEN_RE.exec(value);
+    if (!open)
+        return null;
+    const tag = open[1].toLowerCase();
+    const attrs = [];
+    let pos = open.index + open[0].length;
+    for (;;) {
+        CLOSE_RE.lastIndex = pos;
+        const close = CLOSE_RE.exec(value);
+        if (close) {
+            pos += close[0].length;
+            break;
+        }
+        ATTR_RE.lastIndex = pos;
+        const a = ATTR_RE.exec(value);
+        // Neither an attribute nor the end of the tag: not an element, just a "<".
+        if (!a)
+            return null;
+        pos += a[0].length;
+        const name = a[1].toLowerCase();
+        if (!ATTR_NAME_RE.test(name))
+            continue;
+        attrs.push([name, a[2] ?? a[3] ?? a[4] ?? ""]);
+    }
+    const rest = value.slice(pos);
+    const close = rest.toLowerCase().indexOf(`</${tag}`);
+    const inner = (close >= 0 ? rest.slice(0, close) : rest).trim();
+    const text = inner ? inner.slice(0, INJECTION_TEXT_MAX) : null;
+    if (attrs.length === 0 && text === null)
+        return null;
+    return {
+        payload: value.slice(0, 200),
+        tag,
+        attrs,
+        text,
+        selector: tag + attrs.map(([name, v]) => `[${name}="${cssValue(v)}"]`).join(""),
+    };
+}
+export function injectionProbe(value, field, typedOn, baseline = 0) {
+    const shape = probeShape(value);
+    return shape ? { ...shape, field, typedOn, baseline } : null;
+}
+/**
+ * The session's probe list with one more: a payload already on it is kept as
+ * first seen (its baseline came from where it was first typed), and past the
+ * cap the oldest goes. Returns the list to keep, so the rule is testable.
+ */
+export function rememberProbe(probes, probe) {
+    if (probes.some((p) => p.payload === probe.payload))
+        return [...probes];
+    const kept = probes.length >= MAX_PROBES ? probes.slice(probes.length - MAX_PROBES + 1) : [...probes];
+    return [...kept, probe];
+}
+export function probeQueries(probes) {
+    return probes.map((p) => ({ selector: p.selector, attrs: p.attrs, text: p.text }));
+}
+/**
+ * The script the page runs to find matching elements: the same rules as
+ * matchesElement, applied in the page so the cap counts matches, not
+ * candidates. Returns [{ index, outer }] with at most MAX_HITS per probe.
+ */
+export function probeScript(queries) {
+    return (`(() => { const queries = ${JSON.stringify(queries)}; const max = ${MAX_HITS}; const textMax = ${INJECTION_TEXT_MAX}; const out = []; ` +
+        `queries.forEach((q, index) => { let els; try { els = document.querySelectorAll(q.selector); } catch { return; } let n = 0; ` +
+        `for (const el of els) { if (n >= max) break; if (el.attributes.length !== q.attrs.length) continue; ` +
+        `if (!q.attrs.every(([name, value]) => el.getAttribute(name) === value)) continue; ` +
+        `if (q.text !== null && (el.textContent || '').trim().slice(0, textMax) !== q.text) continue; ` +
+        `out.push({ index, outer: el.outerHTML.slice(0, 200) }); n += 1; } }); return out; })()`);
+}
+/** The rule the script applies, in one place a test can reach. */
+export function matchesElement(query, el) {
+    if (Object.keys(el.attrs).length !== query.attrs.length)
+        return false;
+    if (!query.attrs.every(([name, value]) => el.attrs[name] === value))
+        return false;
+    return query.text === null || el.text.trim().slice(0, INJECTION_TEXT_MAX) === query.text;
+}
+/**
+ * Which hits on a page are injections to report: more matching elements than
+ * the page the value was typed on already held (shared chrome such as a nav
+ * link is the same on every page), and not reported for this route before.
+ */
+export function newInjections(probes, hits, url, reported) {
+    const out = [];
+    const route = routeOf(url);
+    probes.forEach((probe, index) => {
+        const mine = hits.filter((h) => h.index === index);
+        if (mine.length <= probe.baseline)
+            return;
+        const key = `${probe.payload}|${route}`;
+        if (reported.has(key))
+            return;
+        reported.add(key);
+        out.push({ probe, outer: mine[mine.length - 1]?.outer ?? "", key });
+    });
+    return out;
+}
+/**
+ * The violation's detail: what it became, where it fired, and where it was
+ * typed. The element comes first because the oracle log signs a violation on
+ * the first characters of its detail: two payloads that fired on one page
+ * must not read as one.
+ */
+export function describeInjection(probe, url, outerHtml) {
+    return (`${outerHtml.slice(0, 160)} on ${routeOf(url)} is a value typed into ${probe.field} on ${routeOf(probe.typedOn)}, come back as markup — ` +
+        `whoever opens this page runs what was typed there (stored or reflected injection, XSS)`);
+}

package/dist/engine/live-page.js

@@ -31,12 +31,16 @@ export const LIVE_PAGE = `<!doctype html>
     }
   }
   * { box-sizing: border-box; }
+  ::selection { background: color-mix(in srgb, var(--accent) 28%, transparent); }
+  .feed, .brief, #report { scrollbar-width: thin; scrollbar-color: var(--line) transparent; }
+  .badge, .meta, .feed .t, .since, #focus .bar .line { font-variant-numeric: tabular-nums; }
   body { margin: 0; background: var(--bg); color: var(--text); font: 14px/1.45 system-ui, -apple-system, "Segoe UI", sans-serif; }
   header { position: sticky; top: 0; z-index: 2; display: flex; flex-wrap: wrap; gap: 8px 16px; align-items: center;
     padding: 12px 16px; background: var(--panel); border-bottom: 1px solid var(--line); }
   h1 { margin: 0; font-size: 16px; font-weight: 650; }
   .meta { color: var(--muted); font-size: 13px; }
   .spacer { flex: 1 1 auto; }
+  .actions { display: flex; gap: 8px; flex: 0 0 auto; }
   button { font: inherit; color: var(--text); background: var(--panel); border: 1px solid var(--line); border-radius: 6px;
     padding: 5px 10px; cursor: pointer; }
   button:hover { border-color: var(--accent); }
@@ -71,7 +75,7 @@ export const LIVE_PAGE = `<!doctype html>
     font: 11px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; max-height: 108px; overflow-y: auto; overscroll-behavior: contain; }
   .feed .row { display: flex; gap: 6px; white-space: nowrap; }
   /* Consecutive actions of one journey share a tint, so where one goal ends and the next begins is visible in the log. */
-  .feed .group { border-left: 3px solid transparent; padding-left: 4px; margin-left: -4px; border-radius: 3px; }
+  .feed .group { border-left: 1px solid transparent; padding-left: 5px; margin-left: -6px; border-radius: 3px; }
   .feed .g0 { background: rgba(96, 165, 250, .13); border-color: rgba(96, 165, 250, .7); }
   .feed .g1 { background: rgba(52, 211, 153, .13); border-color: rgba(52, 211, 153, .7); }
   .feed .g2 { background: rgba(251, 191, 36, .13); border-color: rgba(251, 191, 36, .7); }
@@ -83,9 +87,9 @@ export const LIVE_PAGE = `<!doctype html>
   .feed .bad { color: var(--stuck); }
   .feed .none { color: var(--muted); }
   #focus .lower { display: flex; gap: 10px; flex: 0 0 auto; height: 30vh; min-height: 140px; }
-  #focus .feed { margin: 0; max-height: none; flex: 2 1 0; min-width: 0; background: #11151b; border-color: #2a303a; }
+  #focus .feed { margin: 0; max-height: none; flex: 2 1 0; min-width: 0; background: #11151b; border-color: #2a303a; scrollbar-color: #2a303a transparent; }
   #focus .brief { flex: 1 1 0; min-width: 0; overflow-y: auto; padding: 10px 14px; background: #11151b; border: 1px solid #2a303a;
-    border-radius: 6px; color: #e6e9ee; }
+    border-radius: 6px; color: #e6e9ee; scrollbar-color: #2a303a transparent; }
   #focus .brief h3 { margin: 0 0 4px; font-size: 11px; font-weight: 700; letter-spacing: .06em; text-transform: uppercase; color: #98a2b3; }
   #focus .brief p { margin: 0 0 14px; font-size: 14px; line-height: 1.45; overflow-wrap: anywhere; }
   #focus .brief p.unset { color: #98a2b3; font-style: italic; }
@@ -132,8 +136,10 @@ export const LIVE_PAGE = `<!doctype html>
   <span class="meta" id="engine" data-testid="live-engine-summary"></span>
   <span class="spacer"></span>
   <span class="meta" id="counts" data-testid="live-session-counts"></span>
-  <button type="button" id="report-open" data-testid="live-report-toggle">Report</button>
-  <button type="button" id="all" aria-pressed="false" data-testid="live-all-toggle">Stream all</button>
+  <span class="actions">
+    <button type="button" id="report-open" data-testid="live-report-toggle">Report</button>
+    <button type="button" id="all" aria-pressed="false" data-testid="live-all-toggle">Stream all</button>
+  </span>
 </header>
 <div id="banner" role="alert" data-testid="live-unreachable-banner">The engine is not answering. It may have exited; this page will pick up again if it comes back.</div>
 <div id="empty" data-testid="live-empty-state">No session is attached yet. Cards appear here as soon as one attaches.</div>

package/dist/engine/live.js

@@ -169,6 +169,36 @@ export function writeStatusFile(dir, body) {
     statusWrites.set(dir, next);
     return next;
 }
+/**
+ * The lines `scenescout status` prints for a status file it could read: the
+ * engine, what it is doing, and one line per session (or the single legacy
+ * line an engine from before the live view wrote). The recent-actions tail
+ * comes from the session log and is printed by the CLI.
+ */
+export function formatStatus(st, alive, nowMs) {
+    const lines = [];
+    const age = st.at ? Math.round((nowMs - new Date(st.at).getTime()) / 1000) : null;
+    lines.push(`Engine pid ${st.pid ?? "?"} — ${alive ? "ALIVE" : "not running (stale status)"}`);
+    lines.push(`${st.phase === "running" ? "⏳ running" : "· idle after"}: ${st.tool ?? "?"}${age !== null ? ` (as of ${age}s ago)` : ""}`);
+    // The file is written by another process and can be caught mid-write, so
+    // only entries whole enough to describe are described.
+    const sessions = wholeSessions(st.detail);
+    if (sessions.length > 0) {
+        lines.push(`Sessions (${sessions.length}):`);
+        for (const entry of sessions)
+            lines.push(`  ${formatSessionLine(entry, nowMs)}`);
+        if (alive && st.live?.port)
+            lines.push("Live view: scenescout watch");
+        if (alive && st.live?.error)
+            lines.push(`Live view unavailable: ${st.live.error}`);
+    }
+    else {
+        lines.push(`Session: ${st.session ?? "?"} (${st.role ?? "?"})${st.sessions && st.sessions.length > 1 ? ` · all sessions: ${st.sessions.join(", ")}` : ""}`);
+        if (st.url)
+            lines.push(`URL: ${st.url}`);
+    }
+    return lines;
+}
 /** The entries of a status file that are whole enough to describe. A truncated write or an older engine can leave others. */
 export function wholeSessions(detail) {
     return (detail ?? []).filter((e) => typeof e.session === "string" &&

package/dist/engine/memory.js

@@ -267,10 +267,15 @@ function endpointSignatures(evidence) {
 function sharesEndpointSignature(a, b) {
     if (!a.evidence || !b.evidence)
         return false;
-    const aSigs = endpointSignatures(a.evidence);
+    // Only a triple with a failure status is a signature of a bug. A bare
+    // `POST /api/orders` (the endpoint answered 2xx, or no status was named)
+    // says which endpoint was involved, not what went wrong: a double submit
+    // and an accepted negative quantity both name it, and are two bugs.
+    const failing = (evidence) => new Set([...endpointSignatures(evidence)].filter((sig) => /\s[45]\d{2}$/.test(sig)));
+    const aSigs = failing(a.evidence);
     if (aSigs.size === 0)
         return false;
-    for (const sig of endpointSignatures(b.evidence))
+    for (const sig of failing(b.evidence))
         if (aSigs.has(sig))
             return true;
     return false;

package/dist/engine/oracles.js

@@ -129,6 +129,14 @@ export class OracleMonitor {
     notePolicyBlock() {
         this.lastPolicyBlockAt = Date.now();
     }
+    /**
+     * A markup-shaped value the session typed has come back as an element on
+     * this page: whoever opens it runs the input. Found by the engine's DOM scan
+     * (injection.ts), not by a page event, so it is reported through here.
+     */
+    noteInjection(detail, url) {
+        this.record({ kind: "dom_injection", severity: "high", detail, url });
+    }
     record(v) {
         if (isPolicyInduced(v, this.lastPolicyBlockAt === null ? null : Date.now() - this.lastPolicyBlockAt)) {
             this.policyAttributed += 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",
@@ -71,7 +71,7 @@
     "mcp-check": "npm run build && npm run mcp-check:run",
     "mcp-check:run": "tsx scripts/mcp-check.ts",
     "test": "npm run build && npm run test:unit && npm run smoke:run && npm run mcp-check:run",
-    "test:unit": "npm run scan-test && npm run oracle-test && npm run policy-test && npm run fixture-test && npm run dispatch-test && npm run design-test && npm run contract-test && npm run memory-test && npm run install-test && npm run live-test && npm run hygiene-test",
+    "test:unit": "npm run scan-test && npm run oracle-test && npm run policy-test && npm run fixture-test && npm run dispatch-test && npm run design-test && npm run contract-test && npm run memory-test && npm run install-test && npm run live-test && npm run demo-test && npm run hygiene-test",
     "scan-test": "tsx scripts/scan-test.ts",
     "oracle-test": "tsx --test scripts/oracle-test.ts",
     "policy-test": "tsx --test scripts/policy-test.ts",
@@ -82,6 +82,7 @@
     "memory-test": "tsx --test scripts/memory-test.ts",
     "install-test": "tsx --test scripts/install-test.ts",
     "live-test": "tsx --test scripts/live-test.ts",
+    "demo-test": "tsx --test scripts/demo-test.ts",
     "hygiene-test": "tsx --test scripts/hygiene-test.ts"
   },
   "dependencies": {

package/skills/scenescout/SKILL.md

@@ -48,7 +48,7 @@ You are the brain of an exploratory UI tester. The SceneScout MCP server gives y
 |---|---|---|
 | `minimal` | Every known route visited (crawl does this) + ≥1 design audit + 1–2 primary journeys as plans + crawl-flagged problems triaged. The report DISCLOSES remaining gaps in its Gap Ledger — minimal is honest-but-fast, not silent. | 1 crawl + 2–4 plans + a few snapshots |
 | `medium` (default) | minimal + design audits on several distinct routes (gate: ≥ min(3, visited/10)) + every unexercised interactable class exercised once + every form submitted valid AND invalid | + interactive passes per module |
-| `extensive` | medium + fuzzing (empty, 1000-char, unicode, `<script>`; for uploads, `scout_upload {name}` with a wrong extension against `accept`, a 255-char name, unicode), back/refresh/deep-link resilience, keyboard-only pass, **an `scout_journey` per module's primary task**, **the impatient-user pass** (below), **≥2 roles compared**, **the anonymous auth-surface pass** (signup / forgot-password walked to the mailbox wall, step 8 above), and source-grounding for every absence-claim. **`scout_report {level:'extensive'}` REFUSES while the Gap Ledger is non-empty** — that refusal IS the completeness guarantee: an extensive report can only exist when every known route is visited, exercised, audited, journey-measured, and role-compared. | budget-capped by user |
+| `extensive` | medium + fuzzing (empty, 1000-char, unicode, and markup such as `<script>` or `<img src=x onerror=…>` — the engine remembers every markup-shaped value you type and reports a `dom_injection` violation when it later renders as an element on any page, which is a stored or reflected XSS: file it as `security`, high, naming the field and the page; for uploads, `scout_upload {name}` with a wrong extension against `accept`, a 255-char name, unicode), back/refresh/deep-link resilience, keyboard-only pass, **an `scout_journey` per module's primary task**, **the impatient-user pass** (below), **≥2 roles compared**, **the anonymous auth-surface pass** (signup / forgot-password walked to the mailbox wall, step 8 above), and source-grounding for every absence-claim. **`scout_report {level:'extensive'}` REFUSES while the Gap Ledger is non-empty** — that refusal IS the completeness guarantee: an extensive report can only exist when every known route is visited, exercised, audited, journey-measured, and role-compared. | budget-capped by user |
 
 **Levels in `observe` mode.** No form submission reaches the server, so "every form submitted valid AND invalid" means submitted and observed client-side; the unsubmitted-forms gap stays in the ledger, worded as the mode's doing. `extensive` refuses while any gap remains, so an `observe` run tops out at `medium` — say so rather than forcing the report.