scenescout 3.12.0 → 3.13.1

package/dist/engine/dedup.js

@@ -0,0 +1,237 @@
+/**
+ * Measuring the finding-dedup decision against the answer keys, and an
+ * optional model-backed judge to measure beside it.
+ *
+ * The store's dedup rule (memory.ts, isDuplicateFinding) decides whether a
+ * newly filed finding is one it already records. Its mistakes are costly both
+ * ways: a wrong merge loses a finding, a missed merge shows one bug twice. This
+ * file turns the archived benchmark runs into labelled pairs — two findings on
+ * one page, "same" when the key classifies both to one entry and "different"
+ * when it classifies them to two — and scores any decider on them with
+ * accuracy, Brier and ECE.
+ *
+ * The model judge asks for a verdict (same / different / unsure) and a
+ * probability through one tool call, so its answer is structured, not parsed
+ * from prose. It is measured here and not used by the store: the rule stays
+ * the only thing that dedups until the judge's Brier beats it on these pairs.
+ * Everything here is pure; the network is the caller's, through `ask`.
+ */
+import { createHash } from "node:crypto";
+import { archiveApp, classify, findingText } from "./bench.js";
+import { MIN_FOR_A_VERDICT } from "./calibration.js";
+import { findingId, isDuplicateFinding } from "./memory.js";
+const pagesOf = (e) => [e.route, ...(e.alsoOn ?? [])];
+const norm = (s) => (s ?? "").toLowerCase().replace(/\s+/g, " ").trim();
+/**
+ * Every pair of findings, within one app across all its archived runs, whose
+ * key entries share a page, labelled by the key. Across runs because that is
+ * where the store dedups: a finding filed by one run against one an earlier
+ * run left. Findings with identical category, title and evidence are collapsed
+ * first, so a phrasing repeated in many runs is one finding, not a crowd of
+ * trivially-same pairs.
+ *
+ * The labels come from the key's patterns, so they are only as good as the
+ * key: a finding the key misclassifies gives a wrong label.
+ */
+export function buildPairs(archives, keys) {
+    const out = { pairs: [], findings: 0, identicalText: 0, unmatched: 0, ambiguous: 0, nonDefect: 0, archivesWithoutKey: 0 };
+    const byApp = new Map();
+    const seen = new Set();
+    for (const archive of archives) {
+        const app = archiveApp(archive);
+        const key = keys[app];
+        if (!key) {
+            out.archivesWithoutKey += 1;
+            continue;
+        }
+        const list = byApp.get(app) ?? [];
+        byApp.set(app, list);
+        for (const f of archive.findings) {
+            const text = `${app}|${norm(f.category)}|${norm(f.title)}|${norm(f.evidence)}`;
+            if (seen.has(text)) {
+                out.identicalText += 1;
+                continue;
+            }
+            seen.add(text);
+            const c = classify(findingText(f), key);
+            if (c === null)
+                out.unmatched += 1;
+            else if (c.kind === "ambiguous")
+                out.ambiguous += 1;
+            else if (c.kind === "nonDefect")
+                out.nonDefect += 1;
+            else {
+                out.findings += 1;
+                list.push({ f: { title: f.title, category: f.category ?? "", evidence: f.evidence, keyId: c.entry.id, run: archive.run }, pages: pagesOf(c.entry) });
+            }
+        }
+    }
+    for (const [app, list] of byApp) {
+        for (let i = 0; i < list.length; i++) {
+            for (let j = i + 1; j < list.length; j++) {
+                const route = list[i].pages.find((p) => list[j].pages.includes(p));
+                if (route === undefined)
+                    continue;
+                out.pairs.push({ app, route, a: list[i].f, b: list[j].f, same: list[i].f.keyId === list[j].f.keyId });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * At most `cap` pairs, chosen by a hash of their texts: the same pairs every
+ * time for the same archives, whatever order they were built in, and no
+ * preference for the runs that happen to be listed first.
+ */
+export function samplePairs(pairs, cap) {
+    if (!Number.isInteger(cap) || cap < 1)
+        throw new Error(`The pair cap must be a positive whole number, not ${cap}.`);
+    const h = (p) => createHash("sha256")
+        .update([p.app, p.route, p.a.run, p.a.title, p.a.evidence ?? "", p.b.run, p.b.title, p.b.evidence ?? ""].join("\n"))
+        .digest("hex");
+    return pairs
+        .map((p) => ({ p, k: h(p) }))
+        .sort((x, y) => (x.k < y.k ? -1 : x.k > y.k ? 1 : 0))
+        .slice(0, cap)
+        .map((x) => x.p);
+}
+const asStored = (f, route) => ({ title: f.title, category: f.category, evidence: f.evidence, detail: "", state: route });
+/**
+ * The store's own rule on a pair, as a judgement: the earlier finding is the
+ * stored one, the later the one being filed. It states no probability, so its
+ * probability is its verdict, 1 or 0.
+ */
+export function ruleJudgement(p) {
+    const existing = { ...asStored(p.a, p.route), id: findingId(asStored(p.a, p.route)) };
+    const same = isDuplicateFinding(existing, asStored(p.b, p.route));
+    return { verdict: same ? "same" : "different", pSame: same ? 1 : 0 };
+}
+// ── the model judge ─────────────────────────────────────────────────────────
+export const JUDGE_TOOL = {
+    name: "judge_pair",
+    description: "Record whether the two findings describe one defect.",
+    parameters: {
+        type: "object",
+        properties: {
+            verdict: { type: "string", enum: ["same", "different", "unsure"] },
+            p_same: { type: "number", minimum: 0, maximum: 1, description: "Probability the two findings are one defect." },
+        },
+        required: ["verdict", "p_same"],
+        additionalProperties: false,
+    },
+};
+export const JUDGE_SYSTEM = "You decide whether two findings filed by exploratory testers of one web app describe the SAME defect or DIFFERENT defects. " +
+    "Same: one root cause a single fix would close, however differently it is worded, categorised or evidenced. " +
+    "Different: two things a developer would fix separately, even on one page, one control or one endpoint. " +
+    "Answer only by calling judge_pair once, with no prose. verdict is same, different or unsure; p_same is your calibrated probability that they are one defect: " +
+    "about 0.5 when the text cannot tell, and near 0 or 1 only when it plainly can. Use unsure only when the findings give too little to go on.";
+/** What the judge is shown: the fields a tester filed, nothing from the key. */
+export function judgeKickoff(route, a, b) {
+    const show = (f) => ({ title: f.title, category: f.category, evidence: f.evidence ?? "" });
+    return `Both findings were filed on the page ${route}.\n\nFinding A: ${JSON.stringify(show(a))}\nFinding B: ${JSON.stringify(show(b))}`;
+}
+/**
+ * Read the judge's one tool call. Anything else — no call, another tool, a
+ * verdict outside the three, a probability outside 0–1 or one that
+ * contradicts its own verdict — is an error, never a guess at what was meant.
+ */
+export function parseJudgement(turn) {
+    const call = turn.calls.find((c) => c.name === JUDGE_TOOL.name);
+    if (!call)
+        return { ok: false, error: turn.note ?? `the model did not call ${JUDGE_TOOL.name}` };
+    if (call.argsError)
+        return { ok: false, error: call.argsError };
+    const input = call.input;
+    const verdict = input?.verdict;
+    const p = input?.p_same;
+    if (verdict !== "same" && verdict !== "different" && verdict !== "unsure")
+        return { ok: false, error: `the verdict ${JSON.stringify(verdict)} is not same, different or unsure` };
+    if (typeof p !== "number" || !Number.isFinite(p) || p < 0 || p > 1)
+        return { ok: false, error: `p_same ${JSON.stringify(p)} is not a probability` };
+    if ((verdict === "same" && p < 0.5) || (verdict === "different" && p > 0.5))
+        return { ok: false, error: `the verdict ${verdict} contradicts p_same ${p}` };
+    return { ok: true, judgement: { verdict, pSame: p } };
+}
+/**
+ * Decide one pair. With no judge the rule decides, as the store does. With a
+ * judge, the model decides when it answers same or different; when it fails
+ * for any reason, or is unsure, the rule decides and the note says why, so a
+ * run never silently becomes a run of the rule.
+ */
+export async function decideDuplicate(p, ask) {
+    const rule = () => ruleJudgement(p).verdict === "same";
+    if (!ask)
+        return { duplicate: rule(), by: "rule" };
+    let parsed;
+    try {
+        parsed = parseJudgement(await ask(JUDGE_SYSTEM, [JUDGE_TOOL], judgeKickoff(p.route, p.a, p.b)));
+    }
+    catch (err) {
+        parsed = { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+    if (!parsed.ok)
+        return { duplicate: rule(), by: "rule", note: `the model judge failed (${parsed.error}); the current rule decided` };
+    if (parsed.judgement.verdict === "unsure")
+        return { duplicate: rule(), by: "rule", judgement: parsed.judgement, note: "the model judge was unsure; the current rule decided" };
+    return { duplicate: parsed.judgement.verdict === "same", by: "model", judgement: parsed.judgement };
+}
+/**
+ * Accuracy, Brier and ECE of a decider over labelled pairs. `judgements[i]`
+ * answers `labels[i]`; null is a judge that gave no usable answer. The
+ * probability is scored against the key's label directly (a proper score for
+ * a yes/no question), not a confidence in the verdict: the two agree whenever
+ * the verdict follows the probability, which parseJudgement enforces.
+ */
+export function scorePairs(labels, judgements, bucketCount = 5) {
+    if (labels.length !== judgements.length)
+        throw new Error(`${labels.length} labels but ${judgements.length} judgements.`);
+    const out = { judged: 0, correct: 0, unsure: 0, failed: 0, sameInKey: 0, accuracy: null, brier: null, brierRef: null, buckets: [], ece: null };
+    const scored = [];
+    labels.forEach((same, i) => {
+        const j = judgements[i];
+        if (j === null)
+            return void (out.failed += 1);
+        if (j.verdict === "unsure")
+            return void (out.unsure += 1);
+        out.judged += 1;
+        if (same)
+            out.sameInKey += 1;
+        if ((j.verdict === "same") === same)
+            out.correct += 1;
+        scored.push({ p: j.pSame, y: same ? 1 : 0 });
+    });
+    if (out.judged < MIN_FOR_A_VERDICT)
+        return out;
+    const n = scored.length;
+    out.accuracy = out.correct / n;
+    out.brier = scored.reduce((s, x) => s + (x.p - x.y) ** 2, 0) / n;
+    const base = out.sameInKey / n;
+    out.brierRef = base * (1 - base);
+    // Equal-count buckets, cut only between different probabilities.
+    const sorted = [...scored].sort((x, y) => x.p - y.p);
+    const target = n / bucketCount;
+    let cur = [];
+    const flush = () => {
+        if (cur.length === 0)
+            return;
+        out.buckets.push({ n: cur.length, stated: cur.reduce((s, x) => s + x.p, 0) / cur.length, actual: cur.reduce((s, x) => s + x.y, 0) / cur.length });
+        cur = [];
+    };
+    sorted.forEach((x, i) => {
+        if (cur.length >= target && x.p !== sorted[i - 1].p)
+            flush();
+        cur.push(x);
+    });
+    flush();
+    out.ece = out.buckets.reduce((s, b) => s + (b.n / n) * Math.abs(b.stated - b.actual), 0);
+    return out;
+}
+/** One line per score, for the bench output and the results log. */
+export function formatPairScore(name, s) {
+    const head = `${name}: ${s.judged} judged (${s.sameInKey} same in the key), ${s.unsure} unsure, ${s.failed} failed`;
+    if (s.accuracy === null)
+        return `${head}; fewer than ${MIN_FOR_A_VERDICT} judged, no figures`;
+    const skill = s.brierRef ? ` (skill ${(1 - s.brier / s.brierRef).toFixed(2)} vs the base rate)` : "";
+    const buckets = s.buckets.map((b) => `n=${b.n} stated ${b.stated.toFixed(2)} actual ${b.actual.toFixed(2)}`).join("; ");
+    return `${head}; accuracy ${(s.accuracy * 100).toFixed(1)}%, Brier ${s.brier.toFixed(3)}${skill}, ECE ${s.ece.toFixed(3)} [${buckets}]`;
+}

package/dist/engine/memory.js

@@ -631,6 +631,22 @@ function sameFinding(a, b) {
         return false;
     return findingJaccard(findingTokens(a.title), findingTokens(b.title)) >= 0.5;
 }
+/** A finding's stored id: its category, title and route, so the same finding filed twice hashes the same. */
+export function findingId(f) {
+    return shortHash(`${f.category}|${f.title.toLowerCase().trim()}|${f.state.split("#")[0]}`);
+}
+/**
+ * The dedup rule `addFinding` applies: whether `incoming` is the finding
+ * `existing` already records. The same id; or, on the same route, the same
+ * finding by evidence, a quoted literal or title overlap (sameFinding); or,
+ * from any route, the same endpoint failing the same way (sameEndpointBug).
+ * Exported so the benchmark scores the rule the store runs, not a copy of it.
+ */
+export function isDuplicateFinding(existing, incoming) {
+    return (existing.id === findingId(incoming) ||
+        (existing.state.split("#")[0] === incoming.state.split("#")[0] && sameFinding(existing, incoming)) ||
+        sameEndpointBug(existing, incoming));
+}
 /** Per-project directory for memory, session logs, and reports. */
 export const MEMORY_DIRNAME = ".scenescout";
 /** The one directory under it that is committed rather than ignored: saved flows (flow.ts). */
@@ -1487,9 +1503,8 @@ export class MemoryStore {
             url: redactSecrets(input.url),
             evidence: input.evidence ? redactSecrets(input.evidence) : input.evidence,
         };
-        const route = f.state.split("#")[0];
-        const id = shortHash(`${f.category}|${f.title.toLowerCase().trim()}|${route}`);
-        const existing = this.data.findings.find((x) => x.id === id || (x.state.split("#")[0] === route && sameFinding(x, f)) || sameEndpointBug(x, f));
+        const id = findingId(f);
+        const existing = this.data.findings.find((x) => isDuplicateFinding(x, f));
         if (existing) {
             existing.runs += 1;
             existing.foundAt = new Date().toISOString();

package/dist/engine/policy.js

@@ -134,6 +134,48 @@ export function destructiveRefusal(label, mode = "read-only") {
         `the user has to re-attach with mode="destructive" against a disposable/seeded environment.`);
 }
 export const WRITE_MODES = ["observe", "read-only", "safe-write", "destructive"];
+/** The stricter of two modes: WRITE_MODES runs from the strictest to the loosest. */
+export function stricterMode(a, b) {
+    return WRITE_MODES.indexOf(a) <= WRITE_MODES.indexOf(b) ? a : b;
+}
+/**
+ * How long a rule that was just loosened still judges writes. A request is
+ * judged when the engine hears of it, which can be after the page sent it: a
+ * beacon a page sends as it is left reaches the browser-level interception
+ * tens of milliseconds after the page has gone, and a routed request waits its
+ * turn behind the handler. Five seconds is two orders of magnitude above the
+ * delays seen, and the price is only that writes sent in the first seconds
+ * after a flow ends are judged by the flow's stricter rule.
+ */
+export const LOOSENED_RULE_HOLD_MS = 5000;
+/**
+ * The write rule in force, as the judges must read it: a request is judged by
+ * the rule in force when the page sent it, which the engine cannot see, so by
+ * the strictest rule in force at any time in the hold before it is judged.
+ * Tightening the rule applies at once; loosening it (a flow handing back to
+ * the crawl) keeps the stricter rule in force for `holdMs`, so a write the
+ * flow's page sent under the flow's rule is never judged under the looser one
+ * because it was heard of a moment late.
+ */
+export class WriteRule {
+    current;
+    holdMs;
+    held = [];
+    constructor(current, holdMs = LOOSENED_RULE_HOLD_MS) {
+        this.current = current;
+        this.holdMs = holdMs;
+    }
+    set(mode, now = Date.now()) {
+        if (stricterMode(this.current, mode) === this.current && this.current !== mode)
+            this.held.push({ mode: this.current, until: now + this.holdMs });
+        this.current = mode;
+    }
+    /** The rule a write heard of now is judged by. */
+    at(now = Date.now()) {
+        this.held = this.held.filter((h) => h.until >= now);
+        return this.held.reduce((rule, h) => stricterMode(rule, h.mode), this.current);
+    }
+}
 /**
  * May this non-GET request leave the page? Auth-flow requests are let through
  * before this is asked. `owned` means the request addresses a record this run

package/dist/engine/provider.js

@@ -0,0 +1,193 @@
+/** Raised for a reply that is not what the API promises: retried like a server error, never run as tool calls. */
+export class MalformedReply extends Error {
+}
+/** The most output one model call may produce. Large enough for a plan of steps; small enough that one reply cannot spend the budget. */
+export const MAX_OUTPUT_TOKENS = 16_000;
+const obj = (v) => (v && typeof v === "object" && !Array.isArray(v) ? v : null);
+const num = (v) => (typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0);
+function parseArgs(raw) {
+    if (raw === undefined || raw === null || raw === "")
+        return { input: {} };
+    if (typeof raw !== "string")
+        return { input: raw };
+    try {
+        return { input: JSON.parse(raw) };
+    }
+    catch (err) {
+        return { argsError: `the arguments were not valid JSON (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+// ── Anthropic Messages API ──────────────────────────────────────────────────
+export class AnthropicConversation {
+    o;
+    messages = [];
+    constructor(o, kickoff) {
+        this.o = o;
+        this.messages.push({ role: "user", content: kickoff });
+    }
+    request(key) {
+        return {
+            url: `${this.o.baseUrl}/messages`,
+            headers: { "content-type": "application/json", "x-api-key": key, "anthropic-version": "2023-06-01" },
+            body: {
+                model: this.o.model,
+                max_tokens: MAX_OUTPUT_TOKENS,
+                // The method and the tools are the same on every call: cached once, read back at a tenth of the price.
+                system: [{ type: "text", text: this.o.system, cache_control: { type: "ephemeral" } }],
+                tools: this.o.tools.map((t) => ({ name: t.name, description: t.description, input_schema: t.parameters })),
+                // And the growing conversation: the top-level breakpoint moves to its last block on every call.
+                cache_control: { type: "ephemeral" },
+                output_config: { effort: this.o.effort },
+                messages: this.messages,
+            },
+        };
+    }
+    accept(reply) {
+        const r = obj(reply);
+        if (!r || !Array.isArray(r.content))
+            throw new MalformedReply("the reply has no content list");
+        const content = r.content;
+        const u = obj(r.usage) ?? {};
+        const cached = num(u.cache_read_input_tokens);
+        const written = num(u.cache_creation_input_tokens);
+        const usage = { input: num(u.input_tokens) + cached + written, cachedInput: cached, cacheWrite: written, output: num(u.output_tokens) };
+        // Kept as returned, thinking blocks included: the API requires them back unchanged.
+        this.messages.push({ role: "assistant", content });
+        const text = content
+            .map(obj)
+            .filter((b) => b?.type === "text")
+            .map((b) => String(b.text ?? ""))
+            .join("\n");
+        const calls = content
+            .map(obj)
+            .filter((b) => b?.type === "tool_use")
+            .map((b, i) => ({
+            id: typeof b.id === "string" ? b.id : `call_${i}`,
+            name: typeof b.name === "string" ? b.name : "",
+            ...(obj(b.input) || b.input === undefined ? { input: b.input ?? {} } : parseArgs(b.input)),
+        }));
+        const stop = r.stop_reason;
+        if (stop === "pause_turn")
+            return { text, calls: [], usage, resume: true };
+        const note = stop === "refusal"
+            ? "the model declined to continue"
+            : stop === "max_tokens" && calls.length === 0
+                ? "the model's reply was cut at its output limit"
+                : undefined;
+        return { text, calls, usage, ...(note ? { note } : {}) };
+    }
+    addResults(results) {
+        // Every result in one user message: splitting them teaches the model to stop calling tools in parallel.
+        this.messages.push({
+            role: "user",
+            content: results.map((r) => ({ type: "tool_result", tool_use_id: r.id, content: r.text, ...(r.isError ? { is_error: true } : {}) })),
+        });
+    }
+}
+// ── OpenAI Responses API ────────────────────────────────────────────────────
+export class OpenAIConversation {
+    o;
+    input = [];
+    constructor(o, kickoff) {
+        this.o = o;
+        this.input.push({ role: "user", content: kickoff });
+    }
+    request(key) {
+        return {
+            url: `${this.o.baseUrl}/responses`,
+            headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+            body: {
+                model: this.o.model,
+                instructions: this.o.system,
+                input: this.input,
+                tools: this.o.tools.map((t) => ({ type: "function", name: t.name, description: t.description, parameters: t.parameters, strict: false })),
+                reasoning: { effort: this.o.effort },
+                max_output_tokens: MAX_OUTPUT_TOKENS,
+                // Stateless: nothing of the tested app is kept on the provider's side
+                // between calls, and the reasoning comes back encrypted so it can be
+                // handed back with the rest of the turn.
+                store: false,
+                include: ["reasoning.encrypted_content"],
+            },
+        };
+    }
+    accept(reply) {
+        const r = obj(reply);
+        if (!r || !Array.isArray(r.output))
+            throw new MalformedReply("the reply has no output list");
+        if (obj(r.error))
+            throw new MalformedReply(`the reply carries an error: ${String(obj(r.error).message ?? "unknown")}`);
+        const output = r.output;
+        const u = obj(r.usage) ?? {};
+        const usage = {
+            input: num(u.input_tokens),
+            cachedInput: num(obj(u.input_tokens_details)?.cached_tokens),
+            cacheWrite: 0,
+            output: num(u.output_tokens),
+        };
+        // Every item goes back as it came: reasoning items and function calls must precede their outputs.
+        this.input.push(...output);
+        const items = output.map(obj);
+        const text = items
+            .filter((i) => i?.type === "message" && Array.isArray(i.content))
+            .flatMap((i) => i.content.map(obj))
+            .filter((c) => c?.type === "output_text")
+            .map((c) => String(c.text ?? ""))
+            .join("\n");
+        const calls = items
+            .filter((i) => i?.type === "function_call")
+            .map((i, k) => ({
+            id: typeof i.call_id === "string" ? i.call_id : `call_${k}`,
+            name: typeof i.name === "string" ? i.name : "",
+            ...parseArgs(i.arguments),
+        }));
+        const incomplete = r.status === "incomplete" ? String(obj(r.incomplete_details)?.reason ?? "incomplete") : undefined;
+        const refused = items.some((i) => i?.type === "message" && Array.isArray(i.content) && i.content.some((c) => obj(c)?.type === "refusal"));
+        const note = refused ? "the model declined to continue" : incomplete && calls.length === 0 ? `the model's reply was cut short (${incomplete})` : undefined;
+        return { text, calls, usage, ...(note ? { note } : {}) };
+    }
+    addResults(results) {
+        for (const r of results)
+            this.input.push({ type: "function_call_output", call_id: r.id, output: r.isError ? `ERROR: ${r.text}` : r.text });
+    }
+}
+// ── retries ─────────────────────────────────────────────────────────────────
+/** A status worth another try: throttling, a timeout, an overloaded or failing server. Never a 4xx the request itself caused. */
+export function retryable(status) {
+    return status === 408 || status === 409 || status === 429 || status >= 500;
+}
+/**
+ * Wait before retry `attempt` (1-based): exponential from `baseMs`, capped,
+ * with full jitter so several jobs throttled at once do not retry in step. A
+ * `retry-after` the server sent is honoured when it is longer, up to the cap.
+ */
+export function backoffMs(attempt, random, o = {}) {
+    const base = o.baseMs ?? 1000;
+    const cap = o.capMs ?? 30_000;
+    const exp = Math.min(cap, base * 2 ** (attempt - 1));
+    const jittered = Math.floor(exp / 2 + random() * (exp / 2));
+    return Math.min(cap, Math.max(jittered, o.retryAfterMs ?? 0));
+}
+/** A `retry-after` header in milliseconds (seconds or an HTTP date), or undefined. */
+export function retryAfterMs(header, now) {
+    if (!header)
+        return undefined;
+    const secs = Number(header);
+    if (Number.isFinite(secs) && secs >= 0)
+        return secs * 1000;
+    const at = Date.parse(header);
+    return Number.isNaN(at) ? undefined : Math.max(0, at - now);
+}
+/** The API's own error message from a failed reply's body, for the log. The caller redacts it. */
+export function errorMessage(status, body) {
+    let message = "";
+    try {
+        const parsed = JSON.parse(body);
+        const e = parsed.error;
+        message = typeof e === "string" ? e : typeof e?.message === "string" ? e.message : typeof parsed.message === "string" ? parsed.message : "";
+    }
+    catch {
+        message = body.slice(0, 200);
+    }
+    return `HTTP ${status}${message ? `: ${message.replace(/\s+/g, " ").slice(0, 300)}` : ""}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.12.0",
+  "version": "3.13.1",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",
@@ -72,7 +72,7 @@
     "mcp-check": "npm run build && npm run mcp-check:run",
     "mcp-check:run": "tsx scripts/mcp-check.ts",
     "test": "npm run build && npm run test:unit && npm run smoke:run && npm run mcp-check:run",
-    "test:unit": "npm run scan-test && npm run oracle-test && npm run policy-test && npm run fixture-test && npm run dispatch-test && npm run design-test && npm run check-test && npm run contract-test && npm run pace-test && npm run request-test && npm run settle-test && npm run claims-test && npm run verify-test && npm run brief-test && npm run lane-test && npm run calibration-test && npm run bench-test && npm run memory-test && npm run install-test && npm run live-test && npm run demo-test && npm run holdout-test && npm run hygiene-test",
+    "test:unit": "npm run scan-test && npm run oracle-test && npm run policy-test && npm run fixture-test && npm run dispatch-test && npm run design-test && npm run check-test && npm run ci-test && npm run qa-test && npm run contract-test && npm run pace-test && npm run request-test && npm run settle-test && npm run claims-test && npm run verify-test && npm run brief-test && npm run lane-test && npm run calibration-test && npm run bench-test && npm run memory-test && npm run install-test && npm run live-test && npm run demo-test && npm run holdout-test && npm run hygiene-test",
     "scan-test": "tsx scripts/scan-test.ts",
     "oracle-test": "tsx --test scripts/oracle-test.ts",
     "policy-test": "tsx --test scripts/policy-test.ts",
@@ -80,6 +80,8 @@
     "dispatch-test": "tsx --test scripts/dispatch-test.ts",
     "design-test": "tsx --test scripts/design-test.ts",
     "check-test": "tsx --test scripts/check-test.ts",
+    "ci-test": "tsx --test scripts/ci-test.ts",
+    "qa-test": "tsx --test scripts/qa-test.ts",
     "contract-test": "tsx --test scripts/contract-test.ts",
     "lane-test": "tsx --test scripts/lane-test.ts",
     "memory-test": "tsx --test scripts/memory-test.ts",
@@ -96,7 +98,9 @@
     "brief-test": "tsx --test scripts/brief-test.ts",
     "calibration-test": "tsx --test scripts/calibration-test.ts",
     "bench": "tsx scripts/bench.ts",
-    "bench-test": "tsx --test scripts/bench-test.ts"
+    "bench:ci": "tsx scripts/bench/ci-record.ts",
+    "bench-test": "tsx --test scripts/bench-test.ts",
+    "dedup-bench": "tsx scripts/dedup-bench.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",