scenescout 3.10.0 → 3.11.1

package/dist/engine/browser.js

@@ -2,19 +2,20 @@ import { chromium, firefox, webkit, } from "playwright";
 import fs from "node:fs";
 import path from "node:path";
 import { elementKey, fingerprintState, isNonPageRoute, normalizePath } from "./fingerprint.js";
-import { AUTH_LOSS_PREFIX, JOURNEY_END, JOURNEY_START, MemoryStore, TASK_SET } from "./memory.js";
+import { AUTH_LOSS_PREFIX, JOURNEY_END, JOURNEY_START, MemoryStore, redactSecrets, TASK_SET } from "./memory.js";
 import { normalizeTask } from "./task.js";
 import { CLAIM_SCAN_SCRIPT, findContradictions } from "./claims.js";
 import { describeInjection, newInjections, probeQueries, probeScript, probeShape, rememberProbe } from "./injection.js";
 import { AuthLossTracker } from "./authloss.js";
 import { COLLECT_INTERACTABLES_SCRIPT, VISIBLE_SRC, geometryIssues, BROKEN_IMAGES_SCRIPT, brokenImageIssues, frameLines, hasVisibleFrame, frameElementKey, frameLabel, masksForeignName, MASKED_NAME, capForeignName, stripForeignHref, frameToPageRect, displayName, missingName, placeholderOnly, placeholderEvidence, describeControl, labelFlag, } from "./collector.js";
-import { OracleMonitor, formatViolations } from "./oracles.js";
+import { OracleMonitor, formatViolations, httpErrorDetail } from "./oracles.js";
 import { extractCreatedIds, isOwnedResource, normalizeId } from "./ownership.js";
 import { formatJourney, measureJourney } from "./journey.js";
+import { describeStep, FLOW_AFTER_LAST_STEP_MS, FLOW_STEP_TIMEOUT_MS, isAction, matchRequest, parseTarget, splitRefusals, TARGET_HELP, urlMatches, } from "./flow.js";
 import { framePath, RECORD_MAX_FRAMES } from "./replay.js";
 import { keepWatchingUrl, normalizePace, SETTLE_TICK_MS, shouldKeepWaiting } from "./settle.js";
 import { buildRequestScript, formatReplay, replaySignature, requestHeaders, resolveMethod, resolveRequestUrl, toReplayResult } from "./request.js";
-import { defaultEngine, focusAdvanceKey, REMOVE_SHARED_WORKER_SCRIPT, screencastSupport, serviceWorkerPolicy, sharedWorkersAllowed, } from "../browsers.js";
+import { defaultEngine, focusAdvanceKey, REMOVE_SHARED_WORKER_SCRIPT, screencastSupport, serviceWorkerPolicy, sharedWorkersAllowed, unloadWriteInterception, } from "../browsers.js";
 import { revealedLines } from "./hover.js";
 import { FORMS_INVENTORY_SCRIPT, FORM_PROBE_BODY, formProbeExpression, formIdentity, formStatus, FORMS_READ_FAILED, FORMS_SUBMIT_UNMATCHED, isEmptySubmit, sameControl, isNavigationTeardown, submits, tracksForm, } from "./forms.js";
 import { explainLaunchFailure, isMissingBrowser } from "./launch.js";
@@ -25,6 +26,7 @@ import { answersWithRefusal, destructiveRefusal, isDestructive, isDestructiveWir
 import { scanProject } from "../scan.js";
 import { analyzeDesign, DESIGN_COLLECT_SCRIPT } from "./design.js";
 import { acceptMatches, generatedUpload } from "./fixtures.js";
+import { bodyDigest, headerOf, isReadMethod, judgeUnseenWrite, pausedRequestBytes, RoutedWrites, UnseenRefusals, unseenWriteSource, } from "./unload.js";
 const SETTLE_MS = 400;
 /**
  * Request URL → pathname, falling back to the raw string for anything
@@ -503,6 +505,19 @@ export class BrowserEngine {
     engineName = "chromium";
     /** Non-GET requests fired since the last action — surfaces silent state mutation in read-only runs (timestamped for attribution). */
     mutationRequests = [];
+    /**
+     * Chromium only (browsers.ts `unloadWriteInterception`): the writes the
+     * route handler already let through, so the browser-level interception that
+     * catches what it never sees does not judge them twice. That session lives
+     * as long as the browser, so a page closed at the end still meets it.
+     */
+    routedWrites = new RoutedWrites();
+    /** Writes refused at the browser level, so the driver's own report of them (a redirect hop failing) is known as the policy's doing. */
+    unseenRefusals = new UnseenRefusals();
+    /** Whether the write policy stopped this request, at the route handler or at the browser level. */
+    refusedByAnyPolicy(req) {
+        return this.refusedByPolicy.has(req) || this.unseenRefusals.has(req.method(), req.url());
+    }
     /**
      * Every request answered since the last action, with its status. The HTTP
      * oracle sees each 4xx as it happens and reports it on its own; this ledger
@@ -579,7 +594,7 @@ export class BrowserEngine {
             url: req.url(),
             status,
             resourceType: req.resourceType(),
-            blockedByPolicy: this.refusedByPolicy.has(req),
+            blockedByPolicy: this.refusedByAnyPolicy(req),
         });
     }
     /**
@@ -699,7 +714,7 @@ export class BrowserEngine {
             this.projectDirNote = ` (its real path could not be resolved: ${err instanceof Error ? err.message : String(err)} — a symlinked project path may be wrongly refused)`;
         }
         this.oracles = new OracleMonitor();
-        this.oracles.setPolicyRefusalCheck((req) => this.refusedByPolicy.has(req));
+        this.oracles.setPolicyRefusalCheck((req) => this.refusedByAnyPolicy(req));
         // A request an embed sends to the app is the app's to answer: only one headed outside the app is the embed's.
         this.oracles.setEmbedAttribution((req) => {
             let site = null;
@@ -849,7 +864,7 @@ export class BrowserEngine {
                     const why = ESCAPE_REFUSAL;
                     // Reported like any refusal, so a click whose navigation this stopped does not read as a click that did nothing.
                     if (this.blockedRequests.length < 20)
-                        this.blockedRequests.push({ at: Date.now(), sig: `navigation to ${req.url().slice(0, 140)}`, answered: false, why });
+                        this.blockedRequests.push({ at: Date.now(), sig: `navigation to ${req.url().slice(0, 140)}`, answered: false, why, type: req.resourceType() });
                     this.logAction({ action: "write-policy:blocked", target: `navigation to ${req.url().slice(0, 140)} (${why})`, url: this.page?.url() ?? "" });
                     this.refusedByPolicy.add(req);
                     this.oracles.notePolicyBlock();
@@ -909,7 +924,7 @@ export class BrowserEngine {
                 const refuse = (why) => {
                     const answered = answersWithRefusal(req.resourceType());
                     if (this.blockedRequests.length < 20)
-                        this.blockedRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 140)}`, answered, why });
+                        this.blockedRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 140)}`, answered, why, type: req.resourceType() });
                     this.logAction({ action: "write-policy:blocked", target: `${method} ${pathname}${why ? ` (${why})` : ""}`, url: this.page?.url() ?? "" });
                     this.refusedByPolicy.add(req);
                     this.oracles.notePolicyBlock();
@@ -933,8 +948,10 @@ export class BrowserEngine {
                     return refuse(`sent from a page of ${offApp}, outside the app`);
                 // Auth/session flows must work in every mode — but never a destructive
                 // one, and in observe only the requests a login itself needs.
-                if (isAuthExempt(this.mode, method, pathname, destructiveWire))
+                if (isAuthExempt(this.mode, method, pathname, destructiveWire)) {
+                    this.routedWrites.note(this.mode, method, url, bodyDigest(req.postDataBuffer()));
                     return route.continue();
+                }
                 let owned = this.isOwnedResource(pathname);
                 // A single UI action commonly fires create-then-immediately-save
                 // (POST gets an id, PUT saves content under it) faster than the
@@ -968,10 +985,22 @@ export class BrowserEngine {
                             .finally(() => this.pendingCreations.delete(task));
                         this.pendingCreations.add(task);
                     }
+                    this.routedWrites.note(this.mode, method, url, bodyDigest(req.postDataBuffer()));
                     return route.continue();
                 }
                 return refuse();
             });
+            // Chromium never routes a write a page sends as it is being left; it is judged at the browser level instead.
+            if (unloadWriteInterception(this.engineName) === "browser-fetch" && this.browser) {
+                try {
+                    await this.interceptUnseenWrites(this.browser);
+                }
+                catch (err) {
+                    // Fail closed: without it, a page being left would write past the policy.
+                    await this.close();
+                    throw new Error(`Could not start the write policy's browser-level interception: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+                }
+            }
         }
         // Popups / target=_blank: adopt same-origin pages as the active page (with
         // oracles attached); close foreign-origin popups so exploration cannot
@@ -998,7 +1027,7 @@ export class BrowserEngine {
                     this.lastSnap = null;
                 }
                 else {
-                    void newPage.close().catch(() => { });
+                    void BrowserEngine.leaveAndClose(newPage);
                 }
             })
                 .catch(() => { });
@@ -1389,7 +1418,11 @@ export class BrowserEngine {
      * route classes (including ?tab= screens) that feed the completion contract,
      * so the contract works for any app, not just filesystem-routed Next.
      */
+    /** Set while a measure-only crawl reads a page: its links are not the app's route list. */
+    harvestPaused = false;
     harvestRoutes(elements) {
+        if (this.harvestPaused)
+            return;
         if (!this.memory)
             return;
         const found = [];
@@ -1813,6 +1846,121 @@ export class BrowserEngine {
             return null;
         return foreign;
     }
+    /**
+     * Pause, at the browser level, every request the context's route handler
+     * lets through or never sees (unload.ts says why), and judge the writes it
+     * never saw. Everything else is sent on at once.
+     */
+    async interceptUnseenWrites(browser) {
+        this.routedWrites.clear();
+        const session = await browser.newBrowserCDPSession();
+        session.on("Fetch.requestPaused", (event) => void this.judgeUnseenRequest(session, event));
+        await session.send("Fetch.enable", { patterns: [{ urlPattern: "*" }] });
+    }
+    async judgeUnseenRequest(session, event) {
+        const { url, method, headers } = event.request;
+        // Every paused request gets exactly one answer, whatever throws on the way: a request left paused hangs its page.
+        let answered = false;
+        const answer = async (allow) => {
+            answered = true;
+            await (allow
+                ? session.send("Fetch.continueRequest", { requestId: event.requestId })
+                : session.send("Fetch.failRequest", { requestId: event.requestId, errorReason: "BlockedByClient" })).catch(() => {
+                /* the request or the browser is already gone */
+            });
+        };
+        try {
+            // Reads, and everything in destructive, go on. A later hop of a redirect is judged like any write: the route handler never sees one.
+            if (isReadMethod(method) || this.mode === "destructive")
+                return await answer(true);
+            const bytes = pausedRequestBytes(event.request);
+            if (this.routedWrites.claim(this.mode, method, url, bodyDigest(bytes)))
+                return await answer(true);
+            let verdict;
+            let pathname = url;
+            try {
+                pathname = pathnameOf(url);
+                const { foreign, offApp } = unseenWriteSource({
+                    appUrl: this.baseUrl,
+                    mode: this.mode,
+                    url,
+                    originHeader: headerOf(headers, "origin"),
+                    referer: headerOf(headers, "referer"),
+                    currentPageUrl: this.page?.url(),
+                    trustedEmbeds: this.trustedEmbeds,
+                    movedByEmbed: this.embedMoves.movedTo,
+                });
+                verdict = judgeUnseenWrite({
+                    mode: this.mode,
+                    method,
+                    pathname,
+                    destructiveWire: isDestructiveWire(pathname, bytes?.toString("utf8")),
+                    foreign,
+                    offApp,
+                    owned: this.isOwnedResource(pathname),
+                });
+            }
+            catch (err) {
+                // Fail closed: a write that cannot be judged is refused, and reported as refused below.
+                console.error(`[scenescout] write policy: could not judge ${method} at the browser level, refused: ${err instanceof Error ? err.message : String(err)}`);
+                verdict = { allow: false };
+            }
+            // Known as refused before the browser fails it, so the driver's report of the failure finds it.
+            if (!verdict.allow)
+                this.unseenRefusals.note(method, url);
+            await answer(verdict.allow);
+            if (verdict.allow) {
+                // Reported like any other write that went out, as the request event does for a routed one.
+                if (!BENIGN_MUTATION_RE.test(url) && this.mutationRequests.length < 20)
+                    this.mutationRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 120)}` });
+                return;
+            }
+            // Refused and reported as any refusal is. Dropped rather than answered: the page that sent it is going or gone.
+            if (this.blockedRequests.length < 20)
+                this.blockedRequests.push({
+                    at: Date.now(),
+                    sig: `${method} ${url.slice(0, 140)}`,
+                    answered: false,
+                    why: verdict.why,
+                    type: (event.resourceType ?? "other").toLowerCase(),
+                });
+            this.logAction({ action: "write-policy:blocked", target: `${method} ${pathname}${verdict.why ? ` (${verdict.why})` : ""}`, url: this.page?.url() ?? "" });
+            this.oracles.notePolicyBlock();
+        }
+        catch (err) {
+            console.error(`[scenescout] write policy: browser-level interception failed on ${method}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            if (!answered) {
+                // Fail closed, and still say so: a refusal nobody hears about reads as a write that went out.
+                try {
+                    this.unseenRefusals.note(method, url);
+                }
+                catch {
+                    /* the error above is already logged */
+                }
+                await answer(false);
+                try {
+                    if (this.blockedRequests.length < 20)
+                        this.blockedRequests.push({
+                            at: Date.now(),
+                            sig: `${method} ${url.slice(0, 140)}`,
+                            answered: false,
+                            type: (event.resourceType ?? "other").toLowerCase(),
+                        });
+                    this.logAction({
+                        action: "write-policy:blocked",
+                        target: `${method} ${url.slice(0, 140)} (not judged: an error in the policy)`,
+                        url: this.page?.url() ?? "",
+                    });
+                    this.oracles.notePolicyBlock();
+                }
+                catch (err) {
+                    console.error(`[scenescout] write policy: could not report a refusal: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
     /** Report (and clear) write-policy blocks since the last action. */
     drainBlocked() {
         this.lastActionBlocked = this.blockedRequests.length;
@@ -1863,7 +2011,7 @@ export class BrowserEngine {
         // to see the DUPLICATES that the reporting dedup below intentionally hides.
         this.lastActionMutationSigs = this.mutationRequests.map((e) => e.sig);
         const fresh = this.mutationRequests
-            .filter((entry) => !this.refusedByPolicy.has(entry.req))
+            .filter((entry) => !entry.req || !this.refusedByAnyPolicy(entry.req))
             .filter((entry) => {
             const key = entry.sig.split("?")[0];
             if (this.reportedMutationSigs.has(key))
@@ -2733,6 +2881,12 @@ export class BrowserEngine {
      * Output is anomaly-oriented: a summary line per route, details only where
      * something is wrong. Navigation-only, so it is safe in read-only mode.
      */
+    /**
+     * `measureOnly`: load and measure the pages and nothing else. No route is
+     * harvested from their links, none is marked visited or attempted, and a
+     * failed load is not remembered, so the pages and what they link to stay on
+     * the unvisited list exactly as before. A check's re-test loads use it.
+     */
     async crawl(paths, opts = {}) {
         const page = this.requirePage();
         const memory = this.memory;
@@ -2768,7 +2922,8 @@ export class BrowserEngine {
                 // Not retried by later crawls in this process (a check would otherwise try it
                 // on every discovery round). Deliberately not written to memory: one outage
                 // must not count a route as covered in every later run's gap ledger.
-                this.loadFailedRoutes.add(normalizePath(url));
+                if (!opts.measureOnly)
+                    this.loadFailedRoutes.add(normalizePath(url));
                 // The browser commits its own error page for this failure tens of
                 // milliseconds after goto has thrown, and that commit interrupts the next
                 // navigation, charging this route's failure to the next one. Wait for it;
@@ -2793,21 +2948,24 @@ export class BrowserEngine {
                 continue;
             }
             await this.settle();
-            const { elements, forms } = await this.collect();
+            this.harvestPaused = opts.measureOnly === true;
+            const { elements, forms } = await this.collect().finally(() => (this.harvestPaused = false));
             const finalUrl = page.url();
             const route = normalizePath(finalUrl);
             const fp = fingerprintState(finalUrl, elements);
-            memory.visitState(fp, finalUrl, route, elements.map((el) => el.key));
-            for (const f of forms)
-                memory.recordForm(fp, f.key, f.guarded);
-            memory.recordRoleAccess(this.role, route, "reached");
+            if (!opts.measureOnly) {
+                memory.visitState(fp, finalUrl, route, elements.map((el) => el.key));
+                for (const f of forms)
+                    memory.recordForm(fp, f.key, f.guarded);
+                memory.recordRoleAccess(this.role, route, "reached");
+            }
             // If we landed somewhere else (auth wall, canonical redirect), the
             // REQUESTED route still counts as covered for THIS role — a role that
             // can't see /admin must not block the completion contract forever. An
             // auth-loss bounce is recorded under a prefix that does NOT count.
             const requestedRoute = normalizePath(url);
             const loginRedirect = this.authLoss.isLoginRedirect(path, finalUrl, this.baseUrl);
-            if (route !== requestedRoute) {
+            if (route !== requestedRoute && !opts.measureOnly) {
                 const outcome = loginRedirect ? `${AUTH_LOSS_PREFIX}${route}` : `landed:${route}`;
                 memory.markAttempted(requestedRoute, outcome, this.role);
                 memory.recordRoleAccess(this.role, requestedRoute, outcome);
@@ -2819,7 +2977,7 @@ export class BrowserEngine {
             this.authLoss.clear();
             // Error-status routes render but would otherwise be re-crawled forever —
             // an attempt with the status satisfies the contract.
-            if (typeof status === "number" && status >= 400)
+            if (typeof status === "number" && status >= 400 && !opts.measureOnly)
                 memory.markAttempted(requestedRoute, `status:${status}`, this.role);
             this.logAction({ action: "crawl", target: path, url: finalUrl, ...(await this.frameFor("crawl")) });
             await this.scanForInjections();
@@ -2889,13 +3047,10 @@ export class BrowserEngine {
         const page = this.requirePage();
         const transcript = [];
         const resolveTarget = (target) => {
-            if (target.startsWith("testid="))
-                return page.locator(`[data-testid=${JSON.stringify(target.slice(7))}]`).first();
-            if (target.startsWith("text="))
-                return page.getByText(target.slice(5), { exact: false }).first();
-            if (target.startsWith("label="))
-                return page.getByLabel(target.slice(6)).first();
-            throw new Error(`Plan targets must be "testid=…", "text=…", or "label=…" (got: ${target})`);
+            const parsed = parseTarget(target);
+            if (!parsed)
+                throw new Error(`Plan targets must be ${TARGET_HELP} (got: ${target})`);
+            return BrowserEngine.locatorFor(page, parsed).first();
         };
         /** Last state captured this plan — reused as the next step's pre-state while the page has not moved. */
         let lastCapture = null;
@@ -3138,6 +3293,227 @@ export class BrowserEngine {
         const ran = transcript.filter((l) => /^\d+\. /.test(l)).length;
         return `PLAN (${ran}/${Math.min(steps.length, 20)} steps ran):\n${transcript.join("\n")}\nTake scout_snapshot to see the resulting state.`;
     }
+    /** A plan's or a flow's target as a Playwright locator (every match; callers pick). */
+    static locatorFor(page, target) {
+        switch (target.by) {
+            case "testid":
+                return page.locator(`[data-testid=${JSON.stringify(target.value)}]`);
+            case "text":
+                return page.getByText(target.value, { exact: false });
+            case "label":
+                return page.getByLabel(target.value);
+            case "role":
+                return page.getByRole(target.role, target.name === undefined ? {} : { name: target.name });
+        }
+    }
+    /**
+     * Replay one saved flow for `scenescout check`. Acts and reports only: the
+     * schema, the matching rules and what an outcome means live in flow.ts and
+     * check.ts. It stops at the first step that breaks, or that the write policy
+     * refuses, and hands back what the oracles caught on the way.
+     *
+     * Stricter than a plan on purpose: a click is never forced through
+     * something covering its target (a user could not click it either), and a
+     * step does not count as done until the page has settled.
+     */
+    async replayFlow(steps, mode = this.mode === "observe" ? "observe" : "read-only") {
+        const page = this.requirePage();
+        // The write policy reads this.mode on every request, so the flow's rule holds for exactly as long as the flow runs.
+        const crawlMode = this.mode;
+        this.mode = mode;
+        const context = this.context;
+        const violations = [];
+        const here = () => {
+            try {
+                const u = new URL(this.page?.url() ?? "");
+                return `${u.pathname}${u.search}`;
+            }
+            catch {
+                return "/";
+            }
+        };
+        /** Responses since the most recent action step: what an expect-request looks through. */
+        let seen = [];
+        const onResponse = (res) => {
+            seen.push({ method: res.request().method(), url: res.url(), status: res.status() });
+        };
+        context.on("response", onResponse);
+        const appOrigin = new URL(this.baseUrl).origin;
+        const refusedBackground = [];
+        const websockets = new Set();
+        const onSocket = (ws) => void websockets.add(ws.url().slice(0, 120));
+        page.on("websocket", onSocket);
+        /** Refused writes since the last call that a step is charged with; background ones (beacons, pings) are only listed (splitRefusals). */
+        const ownRefusals = () => {
+            const { charged, background } = splitRefusals(this.blockedRequests.splice(0), appOrigin);
+            for (const sig of background)
+                if (!refusedBackground.includes(sig) && refusedBackground.length < 20)
+                    refusedBackground.push(sig);
+            return charged;
+        };
+        const done = (outcome) => ({ outcome, violations, refusedBackground, websockets: [...websockets] });
+        // Nothing from the crawl before this flow is charged to it.
+        this.oracles.drain(false);
+        this.blockedRequests = [];
+        const collect = (except) => {
+            const path = here();
+            for (const v of this.oracles.drain())
+                if (v.detail !== except)
+                    violations.push({ path, violation: { kind: v.kind, severity: v.severity, detail: v.detail, url: v.url, ...(v.embed ? { embed: v.embed } : {}) } });
+        };
+        const poll = async (done) => {
+            const until = Date.now() + FLOW_STEP_TIMEOUT_MS;
+            for (;;) {
+                if (done())
+                    return true;
+                if (Date.now() >= until)
+                    return false;
+                await (this.page ?? page).waitForTimeout(100).catch(() => { });
+            }
+        };
+        const firstLine = (err) => (err instanceof Error ? err.message : String(err))
+            .split("\n")[0]
+            .replace(/^[a-z]+\.[a-zA-Z]+: /, "")
+            .trim();
+        try {
+            for (const [i, step] of steps.entries()) {
+                const n = i + 1;
+                const did = describeStep(step);
+                if (isAction(step))
+                    seen = [];
+                let failure = null;
+                let refusal = null;
+                this.actionStartedAt = Date.now();
+                try {
+                    const current = this.requirePage();
+                    if (step.action === "navigate") {
+                        const url = `${this.baseUrl}${step.target}`;
+                        const resp = await current.goto(url, { waitUntil: "domcontentloaded", timeout: 15000 });
+                        await this.settle();
+                        const status = resp?.status() ?? null;
+                        if (status !== null && status >= 400) {
+                            failure = `the page answered HTTP ${status}`;
+                            // The page's own status is this step's failure; the oracle's record of the same response is not a second issue.
+                            // The oracle stores its details redacted (redactViolation), so the comparison is redacted too.
+                            collect(redactSecrets(httpErrorDetail("GET", current.url().replace(/#.*$/, ""), status)));
+                        }
+                    }
+                    else if (step.action === "press") {
+                        refusal = await this.vetFocusedActivation(step.value);
+                        if (!refusal) {
+                            await current.keyboard.press(step.value);
+                            await this.settle();
+                        }
+                    }
+                    else if (step.action === "click" || step.action === "type" || step.action === "select") {
+                        const loc = BrowserEngine.locatorFor(current, parseTarget(step.target)).first();
+                        const found = await loc
+                            .waitFor({ state: "visible", timeout: FLOW_STEP_TIMEOUT_MS })
+                            .then(() => true)
+                            .catch(() => false);
+                        if (!found) {
+                            failure = `nothing visible matches ${step.target} within ${FLOW_STEP_TIMEOUT_MS / 1000}s`;
+                        }
+                        else {
+                            const label = ((await loc.getAttribute("aria-label").catch(() => null)) ??
+                                (await loc.textContent({ timeout: 1000 }).catch(() => null)) ??
+                                "").trim();
+                            if (this.readOnly && step.action !== "type" && isDestructive(label, step.action === "select" ? step.value : undefined)) {
+                                refusal = destructiveRefusal(label || step.target, this.mode);
+                            }
+                            else if (step.action === "click") {
+                                await loc.click({ timeout: FLOW_STEP_TIMEOUT_MS });
+                            }
+                            else if (step.action === "select") {
+                                await loc.selectOption(step.value, { timeout: FLOW_STEP_TIMEOUT_MS });
+                            }
+                            else {
+                                await this.noteProbe(step.value, step.target);
+                                await this.fillOrAppend(loc, step.value, step.replace ?? false);
+                                if (step.pressEnter) {
+                                    const submit = loc.locator("xpath=ancestor::form[1]").locator('[type="submit"], button:not([type="button"]):not([type="reset"])').first();
+                                    const submitLabel = ((await submit.textContent({ timeout: 1000 }).catch(() => "")) ?? "").trim();
+                                    if (this.readOnly && isDestructive(submitLabel))
+                                        refusal = destructiveRefusal(submitLabel, this.mode);
+                                    else
+                                        await loc.press("Enter", { timeout: FLOW_STEP_TIMEOUT_MS });
+                                }
+                            }
+                            if (!refusal)
+                                await this.settle();
+                        }
+                    }
+                    else if (step.action === "expect-text") {
+                        const visible = current.getByText(step.text, { exact: false }).filter({ visible: true }).first();
+                        const ok = await visible
+                            .waitFor({ state: "visible", timeout: FLOW_STEP_TIMEOUT_MS })
+                            .then(() => true)
+                            .catch(() => false);
+                        if (!ok)
+                            failure = `no visible text ${JSON.stringify(step.text)} within ${FLOW_STEP_TIMEOUT_MS / 1000}s`;
+                    }
+                    else if (step.action === "expect-url") {
+                        const ok = await poll(() => urlMatches(step.pattern, this.page?.url() ?? ""));
+                        if (!ok)
+                            failure = `the page is at ${here()}, which does not match /${step.pattern}/`;
+                    }
+                    else {
+                        let last = { ok: false, reason: "" };
+                        await poll(() => (last = matchRequest(step, seen)).ok);
+                        if (!last.ok)
+                            failure = last.reason;
+                    }
+                }
+                catch (err) {
+                    failure = firstLine(err);
+                }
+                await this.scanForInjections().catch(() => { });
+                await this.scanForContradictions().catch(() => { });
+                // What the write policy refused of the app's own requests while this step ran is the step's, whatever caused it.
+                const blocked = ownRefusals();
+                if (!refusal && blocked.length > 0)
+                    refusal = `the ${this.mode} write policy refused ${blocked.join(", ")}`;
+                collect();
+                if (refusal)
+                    return done({ status: "refused", step: n, did, reason: refusal.split("\n")[0], path: here() });
+                if (failure)
+                    return done({ status: "failed", step: n, did, reason: failure, path: here() });
+            }
+            // A write the last step set off can land after its checks ran (a debounced save): wait a moment, settle, look
+            // again; then leave the page while the flow's rule still holds, so nothing it sends on the way out goes under
+            // the crawl's rule, and look once more.
+            await (this.page ?? page).waitForTimeout(FLOW_AFTER_LAST_STEP_MS).catch(() => { });
+            await this.settle().catch(() => { });
+            const late = ownRefusals();
+            collect();
+            await (this.page ?? page).goto("about:blank").catch(() => { });
+            await this.settle().catch(() => { });
+            late.push(...ownRefusals());
+            const last = steps[steps.length - 1];
+            if (late.length > 0 && last) {
+                return done({
+                    status: "refused",
+                    step: steps.length,
+                    did: describeStep(last),
+                    reason: `after the last step, the ${this.mode} write policy refused ${late.join(", ")}`,
+                    path: here(),
+                });
+            }
+            return done({ status: "passed" });
+        }
+        finally {
+            // Leave the flow's page before the crawl's rule comes back, so nothing it still sends goes out under a looser one.
+            await (this.page ?? page).goto("about:blank").catch(() => { });
+            this.blockedRequests = [];
+            this.oracles.drain(false);
+            this.mode = crawlMode;
+            page.off("websocket", onSocket);
+            context.off("response", onResponse);
+            this.refs.clear();
+            this.lastSnap = null;
+            this.snapshotUrl = "";
+        }
+    }
     /** Computed-style design audit of the current page — visual judgment material without pixels. */
     async designAudit() {
         const { url, report } = await this.auditPage();
@@ -3381,6 +3757,23 @@ export class BrowserEngine {
             }
         }
     }
+    /**
+     * Leave a page for about:blank. A write a page sends as it is closed (a
+     * sendBeacon or keepalive fetch on pagehide) is not routed in Firefox or
+     * WebKit, so it reached the server in every mode; one it sends as it
+     * navigates is routed and judged like any other. (Chromium routes neither;
+     * its browser-level interception catches both.)
+     */
+    static async leave(page) {
+        if (page.isClosed() || page.url() === "about:blank")
+            return;
+        await page.goto("about:blank", { timeout: 3000 }).catch(() => { });
+    }
+    /** Close a page the engine will not drive, after leaving it (`leave`), so what it sends on its way out meets the policy. */
+    static async leaveAndClose(page) {
+        await BrowserEngine.leave(page);
+        await page.close().catch(() => { });
+    }
     async close() {
         // Marks the end of the time this session held a browser, so the pace
         // section can say how long it was held with nothing happening. Only when a
@@ -3388,6 +3781,10 @@ export class BrowserEngine {
         // is not an event.
         if (this.page)
             this.logAction({ action: "close", url: this.page.isClosed() ? "" : this.page.url() });
+        // Every page is left before it is closed, while the write policy still holds, so what a page sends on its way out
+        // is judged and its refusal logged before the flush below.
+        const pages = this.context?.pages() ?? [];
+        await BrowserEngine.settleWithin(Promise.allSettled(pages.map((p) => BrowserEngine.leave(p))), 5000);
         // Pending debounced coverage writes must land before the process can exit.
         try {
             this.memory?.flush();
@@ -3403,13 +3800,16 @@ export class BrowserEngine {
         // If teardown overruns the cap, the leftover process is reaped by the
         // orphan cleaner on the next attach (or server start).
         await BrowserEngine.settleWithin((async () => {
-            await this.page?.close().catch(() => { });
+            for (const p of this.context?.pages() ?? [])
+                await p.close().catch(() => { });
             await this.context?.close().catch(() => { });
             await this.browser?.close().catch(() => { });
         })(), 8000);
         this.page = null;
         this.context = null;
         this.browser = null;
+        this.routedWrites.clear();
+        this.unseenRefusals.clear();
         this.refs.clear();
         this.snapshotUrl = "";
         this.currentFingerprint = "";