scenescout 3.13.0 → 3.14.0

package/dist/engine/expiry.js

@@ -0,0 +1,254 @@
+/**
+ * How long a saved sign-in profile will last, read from the profile itself:
+ * each cookie's `expires`, and the `exp` claim of any JWT found in a cookie
+ * value or a localStorage value. A JWT's payload is decoded to read `exp` and
+ * nothing else; its signature is never checked (there is no key to check it
+ * with, and nothing here trusts it), and no token value is ever returned,
+ * printed or logged — only the name of the cookie or storage key it was in.
+ *
+ * Used twice: `scenescout login` says how long the profile it just saved will
+ * last, and scout_lane_brief refuses to hand out lanes that attach by a role
+ * whose profile will not outlast the run.
+ *
+ * The verdict refuses only when it is certain. A profile holds more than the
+ * sign-in: analytics cookies that expire in a minute, preference cookies that
+ * last a year. So the profile counts as lasting until its LAST dated
+ * credential expires, and a session cookie with no date (it lives until the
+ * browser closes, and the server decides when it stops working) means the
+ * end is unknown. The first credential to expire is still reported, as a
+ * warning when it falls inside the run.
+ *
+ * Playwright-free and table-tested in profiles-test.
+ */
+import fs from "node:fs";
+import { sayDuration } from "./pace.js";
+/** Default run length the lane check assumes when the planner names none. */
+export const DEFAULT_RUN_MINUTES = 60;
+/** Default slack past the run's end a profile must still last, so a lane is not signed out while writing its report. */
+export const DEFAULT_EXPIRY_MARGIN_MINUTES = 10;
+/** A JWT: three base64url parts, the first two starting with `{"` (eyJ). */
+const JWT_RE = /eyJ[A-Za-z0-9_-]{2,}\.eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*/g;
+/** Longest value scanned for tokens; a larger one is skipped rather than searched. */
+const MAX_SCAN_CHARS = 64 * 1024;
+/** Most tokens read out of one value. */
+const MAX_TOKENS_PER_VALUE = 8;
+/** The `exp` of a JWT in epoch ms, or null when the payload cannot be read or has none. Never verifies the signature. */
+export function jwtExpiry(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!payload || typeof payload !== "object")
+        return null;
+    const exp = payload.exp;
+    if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= 0)
+        return null;
+    return exp * 1000;
+}
+/** Every JWT expiry in a value, and how many JWT-shaped strings in it had none readable. URL-encoded values are decoded first. */
+function tokenExpiries(raw) {
+    if (raw.length > MAX_SCAN_CHARS)
+        return { expiries: [], unreadable: 0 };
+    let value = raw;
+    if (value.includes("%")) {
+        try {
+            value = decodeURIComponent(value);
+        }
+        catch {
+            // Not valid percent-encoding: scan it as it is.
+        }
+    }
+    const found = (value.match(JWT_RE) ?? []).slice(0, MAX_TOKENS_PER_VALUE);
+    const expiries = [];
+    let unreadable = 0;
+    for (const token of found) {
+        const at = jwtExpiry(token);
+        if (at === null)
+            unreadable += 1;
+        else
+            expiries.push(at);
+    }
+    return { expiries, unreadable };
+}
+/** Whether a cookie set for `domain` is sent to `host`, per the cookie domain-match rule. */
+export function cookieMatchesHost(domain, host) {
+    const d = domain.replace(/^\./, "").toLowerCase();
+    const h = host.toLowerCase();
+    return h === d || h.endsWith(`.${d}`);
+}
+/**
+ * Read every credential a storage state holds. With `url`, only cookies sent
+ * to its host and localStorage of its origin count: the rest belong to other
+ * sites the sign-in passed through (an identity provider, say) and do not
+ * sign the app in.
+ */
+export function readLifetime(state, opts = {}) {
+    const s = (state && typeof state === "object" ? state : {});
+    let target;
+    if (opts.url) {
+        try {
+            target = new URL(opts.url);
+        }
+        catch {
+            target = undefined;
+        }
+    }
+    const credentials = [];
+    let unreadableTokens = 0;
+    let elsewhere = 0;
+    for (const c of Array.isArray(s.cookies) ? s.cookies : []) {
+        if (!c || typeof c !== "object")
+            continue;
+        const cookie = c;
+        if (typeof cookie.name !== "string")
+            continue;
+        if (target && typeof cookie.domain === "string" && !cookieMatchesHost(cookie.domain, target.hostname)) {
+            elsewhere += 1;
+            continue;
+        }
+        const dated = typeof cookie.expires === "number" && Number.isFinite(cookie.expires) && cookie.expires > 0 ? cookie.expires * 1000 : null;
+        const tokens = typeof cookie.value === "string" ? tokenExpiries(cookie.value) : { expiries: [], unreadable: 0 };
+        unreadableTokens += tokens.unreadable;
+        if (tokens.expiries.length > 0) {
+            // The cookie stops working at whichever comes first: the browser
+            // dropping it, or the server refusing the token inside it.
+            const jwtAt = Math.min(...tokens.expiries);
+            const at = dated === null ? jwtAt : Math.min(dated, jwtAt);
+            credentials.push({ source: at === dated ? "cookie" : "cookie-jwt", name: cookie.name, expiresAt: at });
+        }
+        else {
+            credentials.push({ source: "cookie", name: cookie.name, expiresAt: dated });
+        }
+    }
+    for (const o of Array.isArray(s.origins) ? s.origins : []) {
+        if (!o || typeof o !== "object")
+            continue;
+        const origin = o;
+        if (target && origin.origin !== target.origin)
+            continue;
+        for (const item of Array.isArray(origin.localStorage) ? origin.localStorage : []) {
+            if (!item || typeof item !== "object")
+                continue;
+            const entry = item;
+            if (typeof entry.name !== "string" || typeof entry.value !== "string")
+                continue;
+            // A localStorage entry with no token in it is not a credential this can
+            // date (most are preferences), so it is not counted at all.
+            const tokens = tokenExpiries(entry.value);
+            unreadableTokens += tokens.unreadable;
+            if (tokens.expiries.length > 0)
+                credentials.push({ source: "local-storage-jwt", name: entry.name, expiresAt: Math.min(...tokens.expiries) });
+            // A token with no readable expiry (a refresh token often has none) may
+            // keep the sign-in alive past every dated one: undated, not ignored.
+            else if (tokens.unreadable > 0)
+                credentials.push({ source: "local-storage-jwt", name: entry.name, expiresAt: null });
+        }
+    }
+    const dated = credentials.filter((c) => c.expiresAt !== null).sort((a, b) => a.expiresAt - b.expiresAt);
+    return { credentials, dated, undated: credentials.length - dated.length, elsewhere, unreadableTokens };
+}
+/** A span as a person says it; days past two, since "73h00m" reads badly. */
+export function sayLifetime(ms) {
+    const days = Math.floor(ms / 86_400_000);
+    return days >= 2 ? `${days} days` : sayDuration(ms);
+}
+function describeCredential(c) {
+    const where = c.source === "cookie" ? "cookie" : c.source === "cookie-jwt" ? "token in cookie" : "token in localStorage";
+    return `${where} "${c.name.slice(0, 60)}"`;
+}
+/**
+ * The line `scenescout login` prints after saving: how long the profile will
+ * last, and what that is read from. Names only, never values.
+ */
+export function describeLifetime(life, now) {
+    const live = life.dated.filter((c) => c.expiresAt > now);
+    const last = live.at(-1);
+    const first = live[0];
+    const undatedNote = life.undated > 0
+        ? `${life.undated} credential${life.undated === 1 ? "" : "s"} with no date (a session cookie, or a token with no expiry; the server decides when ${life.undated === 1 ? "it stops" : "they stop"} working)`
+        : "";
+    if (!last) {
+        if (life.dated.length > 0 && life.undated === 0)
+            return "Lasts: every dated credential in it has already expired, so it is unlikely to sign anyone in. Sign in again.";
+        if (life.undated > 0)
+            return `Lasts: unknown — ${life.dated.length > 0 ? "its dated credentials have already expired, leaving" : "no expiry found, only"} ${undatedNote}.`;
+        return "Lasts: unknown — no cookie or token with an expiry was found in it.";
+    }
+    const lastIn = sayLifetime(last.expiresAt - now);
+    let line = life.undated > 0
+        ? `Lasts: unknown — the last dated credential, ${describeCredential(last)}, ends in ${lastIn}, but it also holds ${undatedNote}.`
+        : `Lasts: about ${lastIn} (the last dated credential, ${describeCredential(last)}).`;
+    if (first && first !== last)
+        line += ` The first to expire is ${describeCredential(first)}, in ${sayLifetime(first.expiresAt - now)}.`;
+    return line;
+}
+/**
+ * Judge a profile against a run of `runMs` plus `marginMs`. Refused only when
+ * every credential it holds is dated, no cookie for another host was left
+ * out, and the last of them ends before the run does; see the header for why the last and not the first. `rerun` is the
+ * command that records the profile again.
+ */
+export function judgeLifetime(life, opts) {
+    const needUntil = opts.now + opts.runMs + opts.marginMs;
+    const needs = `a run of ${sayLifetime(opts.runMs)} plus ${sayLifetime(opts.marginMs)} margin`;
+    const redo = `Run \`${opts.rerun}\` again, sign in, then plan the lanes again.`;
+    if (life.dated.length === 0) {
+        return {
+            kind: "unknown",
+            message: `No expiry was found in the saved sign-in for role "${opts.role}"${life.undated > 0 ? " (only credentials with no date)" : ""}, so whether it lasts the run is unknown. If lanes start landing on the sign-in page, run \`${opts.rerun}\` again.`,
+        };
+    }
+    const last = life.dated.at(-1);
+    const first = life.dated[0];
+    const lastAt = last.expiresAt;
+    // Certain only when every credential the app is sent is dated and nothing
+    // was left out that could still be keeping the sign-in alive.
+    const certain = life.undated === 0 && life.elsewhere === 0;
+    if (certain && lastAt <= opts.now) {
+        return {
+            kind: "refuse",
+            message: `The saved sign-in for role "${opts.role}" has expired: every dated credential in it ended, the last ${sayLifetime(opts.now - lastAt)} ago. ${redo}`,
+        };
+    }
+    if (certain && lastAt < needUntil) {
+        return {
+            kind: "refuse",
+            message: `The saved sign-in for role "${opts.role}" will not last the run: it ends in ${sayLifetime(lastAt - opts.now)} (${describeCredential(last)}), and the lanes need ${needs}. ${redo} (A shorter run or a smaller margin can be passed as runMinutes / expiryMarginMinutes.)`,
+        };
+    }
+    if (first.expiresAt < needUntil) {
+        const firstAt = first.expiresAt;
+        const when = firstAt <= opts.now ? `expired ${sayLifetime(opts.now - firstAt)} ago` : `expires in ${sayLifetime(firstAt - opts.now)}`;
+        return {
+            kind: "warn",
+            message: `In the saved sign-in for role "${opts.role}", ${describeCredential(first)} ${when}, inside ${needs}. It is not the only credential, so the sign-in may outlast it; if lanes start landing on the sign-in page, run \`${opts.rerun}\` again.`,
+        };
+    }
+    return { kind: "ok" };
+}
+/** Read a profile file and judge it. A file that cannot be read or parsed is thrown: attach would fail on it too. */
+export function judgeProfileFile(file, opts, read = (p) => fs.readFileSync(p, "utf8")) {
+    let text;
+    try {
+        text = read(file);
+    }
+    catch (err) {
+        const code = err.code ?? "read error";
+        throw new Error(`the saved sign-in for role "${opts.role}" could not be read (${code}); run \`${opts.rerun}\` again`);
+    }
+    let state;
+    try {
+        state = JSON.parse(text);
+    }
+    catch {
+        // The parser's message quotes the text around the fault, and the text is a live session: say only that it is not JSON.
+        throw new Error(`the saved sign-in for role "${opts.role}" is not valid JSON; run \`${opts.rerun}\` again`);
+    }
+    return judgeLifetime(readLifetime(state, { url: opts.url }), opts);
+}

package/dist/engine/fingerprint.js

@@ -97,11 +97,11 @@ export function elementKey(el) {
 export function fingerprintState(url, elements) {
     const route = normalizePath(url);
     const keys = [...new Set(elements.map(elementKey))].sort();
-    const hash = createHash("sha1").update(keys.join("|")).digest("hex").slice(0, 8);
+    const hash = createHash("sha256").update(keys.join("|")).digest("hex").slice(0, 8);
     return `${route}#${hash}`;
 }
 export function shortHash(input) {
-    return createHash("sha1").update(input).digest("hex").slice(0, 10);
+    return createHash("sha256").update(input).digest("hex").slice(0, 10);
 }
 /**
  * A route as a lane wrote it, with every query string and every fragment that

package/dist/engine/flow.js

@@ -24,8 +24,6 @@ import { MEMORY_DIRNAME, SELF_IGNORE_KEEP } from "./memory.js";
 export const MAX_FLOW_STEPS = 50;
 /** Most flows one check replays. */
 export const MAX_FLOWS = 50;
-/** How long a step waits for its target, text, URL or request before it counts as broken. */
-export const FLOW_STEP_TIMEOUT_MS = 5000;
 /**
  * How long a flow waits after its last step for a write that step set off
  * late (a save on a timer, a debounced autosave), before it counts as passed.

package/dist/engine/limits.js

@@ -0,0 +1,144 @@
+/**
+ * How long the engine waits for one action on the page (a click, typing, a
+ * hover, a pick from a list) and for one page to load, before it calls the
+ * wait a failure.
+ *
+ * On a loaded machine — a shared CI runner, a laptop building something else —
+ * the defaults can run out while the app is fine, and the run then reports a
+ * timeout that belongs to the machine. So both are settings: a scout_attach
+ * option (or a `scenescout check` / `ci` flag) wins over an environment
+ * variable, which wins over the default. The defaults are the values the
+ * engine has always used.
+ *
+ * It lives apart from browser.ts so the precedence, the bounds and the
+ * parsing are table-tested (scripts/limits-test.ts) without a browser.
+ */
+export const DEFAULT_ACTION_TIMEOUT_MS = 5000;
+export const DEFAULT_NAV_TIMEOUT_MS = 20000;
+/** The crawl has always given each route less than a deliberate navigation. */
+export const DEFAULT_CRAWL_NAV_TIMEOUT_MS = 15000;
+/** Going back and a popup's load have always had the shortest wait. */
+export const DEFAULT_BACK_NAV_TIMEOUT_MS = 10000;
+export const DEFAULT_TIME_LIMITS = {
+    actionMs: DEFAULT_ACTION_TIMEOUT_MS,
+    navMs: DEFAULT_NAV_TIMEOUT_MS,
+    crawlNavMs: DEFAULT_CRAWL_NAV_TIMEOUT_MS,
+    backNavMs: DEFAULT_BACK_NAV_TIMEOUT_MS,
+};
+export const ACTION_TIMEOUT_ENV = "SCENESCOUT_ACTION_TIMEOUT_MS";
+export const NAV_TIMEOUT_ENV = "SCENESCOUT_NAV_TIMEOUT_MS";
+/** Inclusive bounds. Under a second is no wait at all; past the maximum a stuck page holds the run for minutes per step. */
+export const LIMIT_BOUNDS = {
+    action: { min: 1000, max: 120_000 },
+    nav: { min: 1000, max: 300_000 },
+};
+/** How each limit is set, by name, for errors and for the hint a timeout carries. */
+export const LIMIT_NAMES = {
+    action: { what: "action limit", option: "actionTimeoutMs", flag: "--action-timeout-ms", env: ACTION_TIMEOUT_ENV },
+    nav: { what: "page-load limit", option: "navTimeoutMs", flag: "--nav-timeout-ms", env: NAV_TIMEOUT_ENV },
+};
+function boundsText(kind) {
+    const { min, max } = LIMIT_BOUNDS[kind];
+    return `a whole number of milliseconds from ${min} to ${max}`;
+}
+/** Check one value against its bounds. `source` names where it came from, so the error says what to fix. */
+export function checkLimit(kind, value, source) {
+    const { min, max } = LIMIT_BOUNDS[kind];
+    if (!Number.isInteger(value) || value < min || value > max) {
+        throw new Error(`${source} must be ${boundsText(kind)} (got ${value}).`);
+    }
+    return value;
+}
+/**
+ * Read one limit from text (an environment variable, a CLI flag). Digits only:
+ * "5s", "5000ms", "1e4" and "-1" are refused rather than guessed at.
+ */
+export function parseLimit(kind, raw, source) {
+    const text = raw.trim();
+    if (!/^\d+$/.test(text))
+        throw new Error(`${source} must be ${boundsText(kind)} (got "${raw}").`);
+    return checkLimit(kind, Number(text), source);
+}
+/** A CLI flag's value, as the argument parsers want it: a number or a sentence. */
+export function parseLimitFlag(kind, raw) {
+    if (raw === undefined)
+        return { ok: true, value: undefined };
+    try {
+        return { ok: true, value: parseLimit(kind, raw, LIMIT_NAMES[kind].flag) };
+    }
+    catch (err) {
+        return { ok: false, error: err.message.replace(/\.$/, "") };
+    }
+}
+function pick(kind, option, env) {
+    const names = LIMIT_NAMES[kind];
+    if (option !== undefined)
+        return checkLimit(kind, option, names.option);
+    const raw = env[names.env];
+    if (raw === undefined || raw.trim() === "")
+        return undefined;
+    return parseLimit(kind, raw, names.env);
+}
+/**
+ * Only the limits that were set, by option or environment, each checked. For
+ * a command with defaults of its own (signing in to save a login profile
+ * waits longer than an exploring session), which applies a set limit and
+ * otherwise keeps its own.
+ */
+export function explicitLimits(options, env) {
+    const action = pick("action", options.actionTimeoutMs, env);
+    const nav = pick("nav", options.navTimeoutMs, env);
+    return { ...(action !== undefined ? { actionMs: action } : {}), ...(nav !== undefined ? { navMs: nav } : {}) };
+}
+/**
+ * The limits a session runs with: the option when given, else the
+ * environment variable when set, else the default. A value out of bounds
+ * throws, naming where it came from — an attach never starts on a limit it
+ * would silently replace.
+ */
+export function resolveTimeLimits(options, env) {
+    const { actionMs: action, navMs: nav } = explicitLimits(options, env);
+    return {
+        actionMs: action ?? DEFAULT_ACTION_TIMEOUT_MS,
+        navMs: nav ?? DEFAULT_NAV_TIMEOUT_MS,
+        crawlNavMs: nav ?? DEFAULT_CRAWL_NAV_TIMEOUT_MS,
+        backNavMs: nav ?? DEFAULT_BACK_NAV_TIMEOUT_MS,
+    };
+}
+/**
+ * A tool call's watchdog, given the session's limits. The watchdogs are sized
+ * for the default limits; a session that raised them gets the watchdog
+ * lengthened by as much, so a raised limit is what ends a slow call, with its
+ * hint, rather than the watchdog. An action is counted twice: a click that
+ * timed out is retried once. Never shorter than the base.
+ */
+export function watchdogFor(baseMs, limits) {
+    const moreAction = Math.max(0, limits.actionMs - DEFAULT_ACTION_TIMEOUT_MS);
+    const moreNav = Math.max(0, limits.navMs - DEFAULT_NAV_TIMEOUT_MS, limits.crawlNavMs - DEFAULT_CRAWL_NAV_TIMEOUT_MS);
+    return baseMs + 2 * moreAction + moreNav;
+}
+/** True for a Playwright timeout ("Timeout 5000ms exceeded", "page.goto: Timeout 20000ms exceeded."). */
+export function isTimeoutMessage(message) {
+    return /\bTimeout \d+ms exceeded/i.test(message);
+}
+const HINT_MARK = "ran out. If the machine is loaded";
+/** What to say when a limit ran out: which one, how long it was, and how to raise it. */
+export function limitHint(kind, ms) {
+    const n = LIMIT_NAMES[kind];
+    return (`the ${n.what} (${ms} ms) ${HINT_MARK} rather than the app slow, raise it: ` +
+        `${n.option} on scout_attach, ${n.flag} on scenescout check or ci, or ${n.env} in the environment`);
+}
+/**
+ * The same error with the hint added when it is a timeout, unchanged otherwise.
+ * The hint goes on line 1, since callers cut a Playwright error to its first
+ * line; the call log below it is kept. An error that already carries a hint is
+ * returned as it is.
+ */
+export function explainTimeout(err, kind, ms) {
+    if (!(err instanceof Error) || !isTimeoutMessage(err.message) || err.message.includes(HINT_MARK))
+        return err;
+    const [first, ...rest] = err.message.split("\n");
+    const out = new Error([`${first} — ${limitHint(kind, ms)}.`, ...rest].join("\n"));
+    out.name = err.name;
+    return out;
+}

package/dist/engine/live-page.js

@@ -259,6 +259,11 @@ export const LIVE_PAGE = `<!doctype html>
   // was, unless the viewer used the close-up's own Stream button, whose choice
   // stands.
   var focusStartedStream = false;
+  // The close-up's still, loaded off-screen and swapped in once it has
+  // arrived: one request at a time, and a single failed capture leaves the
+  // picture up rather than blanking the stage until the next poll.
+  var focusStill = null;
+  var focusStillFailures = 0;
   var skew = 0;
   var latest = {};
   var focusTick = 0;
@@ -358,7 +363,11 @@ export const LIVE_PAGE = `<!doctype html>
     // Frames for a live card arrive over the shared connection; the thumbnail poll takes over again when it is switched off.
     if (on && frames[card.name]) card.img.src = frames[card.name];
     if (!on) card.img.src = shotUrl(card.name);
-    if (focused === card.name) paintFocusStream();
+    if (focused === card.name) {
+      // A failure counted before streaming began says nothing about the stills after it.
+      focusStillFailures = 0;
+      paintFocusStream();
+    }
     syncEvents();
   }
   // The close-up's Stream button is the card's, shown where the viewer is looking.
@@ -370,7 +379,32 @@ export const LIVE_PAGE = `<!doctype html>
     button.setAttribute('aria-pressed', card.live ? 'true' : 'false');
     button.textContent = card.live ? 'Streaming' : 'Stream';
     // Off, the picture is a still that the status poll refreshes.
-    if (!card.live && !scrubbed) document.getElementById('focus-img').src = shotUrl(card.name);
+    if (!card.live && !scrubbed) refreshFocusStill(card.name);
+  }
+  function refreshFocusStill(name) {
+    if (focusStill) return;
+    var next = new Image();
+    focusStill = next;
+    function current() {
+      var card = cards[name];
+      return focusStill === next && focused === name && card && !card.live && !scrubbed;
+    }
+    next.onload = function () {
+      if (current()) {
+        focusStillFailures = 0;
+        document.getElementById('focus-img').src = next.src;
+      }
+      if (focusStill === next) focusStill = null;
+    };
+    next.onerror = function () {
+      if (current()) {
+        focusStillFailures += 1;
+        // One failure can be a capture that missed; two in a row is a session with nothing to show.
+        if (focusStillFailures >= 2) document.getElementById('focus-stage').classList.add('empty');
+      }
+      if (focusStill === next) focusStill = null;
+    };
+    next.src = shotUrl(name);
   }
   function refreshThumb(card) {
     if (card.live || document.hidden) return;
@@ -426,7 +460,12 @@ export const LIVE_PAGE = `<!doctype html>
     root.appendChild(top); root.appendChild(task); root.appendChild(doing); root.appendChild(pace); root.appendChild(tool); root.appendChild(url); root.appendChild(shot); root.appendChild(feed); root.appendChild(foot);
 
     var card = { name: name, root: root, role: role, badge: badge, task: task, doing: doing, pace: pace, tool: tool, url: url, shot: shot, img: img, feed: feed, toggle: toggle, spec: spec, live: false };
-    toggle.addEventListener('click', function () { setLive(card, !card.live); });
+    toggle.addEventListener('click', function () {
+      // Reachable from the keyboard behind an open close-up: a choice made on
+      // the card stands after the close-up closes, as one made in it does.
+      if (focused === name) focusStartedStream = false;
+      setLive(card, !card.live);
+    });
     shot.addEventListener('click', function () { openFocus(name); });
     img.src = shotUrl(name);
     if (streamAll) setLive(card, true);
@@ -798,7 +837,14 @@ export const LIVE_PAGE = `<!doctype html>
   }
 
   function openFocus(name) {
+    // Reachable from the keyboard with a close-up already open: hand the first
+    // session back as it was before showing the next, or a stream it started
+    // is left running with nothing to switch it off.
+    if (focused === name) return;
+    if (focused) closeFocus();
     focused = name;
+    focusStill = null;
+    focusStillFailures = 0;
     scrubbed = null;
     // The ticks belong to the session just left; showing them under this one's
     // name, and playing its frames when one is clicked, is worse than none.
@@ -829,6 +875,7 @@ export const LIVE_PAGE = `<!doctype html>
     document.getElementById('focus-img').removeAttribute('src');
     if (focusStartedStream && was && cards[was]) setLive(cards[was], false);
     focusStartedStream = false;
+    focusStill = null;
     syncEvents();
     if (was && cards[was]) cards[was].shot.focus();
   }
@@ -885,10 +932,12 @@ export const LIVE_PAGE = `<!doctype html>
     var s = focused && latest[focused];
     var line = document.getElementById('focus-line');
     paintBrief();
+    // Before the early return: a session that has closed has no card, and its
+    // Stream button must go with it rather than stay up doing nothing.
+    paintFocusStream();
     if (!s) { line.textContent = focused ? 'This session has closed.' : ''; return; }
     var d = describe(s);
     line.textContent = d.badge + ' · ' + d.tool + ' · ' + (s.url || '');
-    paintFocusStream();
     if (focusTick % 3 === 0) loadFullFeed(focused);
     focusTick += 1;
   }
@@ -991,6 +1040,10 @@ export const LIVE_PAGE = `<!doctype html>
     streamAll = !streamAll;
     this.setAttribute('aria-pressed', streamAll ? 'true' : 'false');
     this.textContent = streamAll ? 'Streaming all' : 'Stream all';
+    // A choice for every card, the close-up's included: closing it afterwards
+    // must not undo it for that one card. Reachable from the keyboard while a
+    // close-up is open, since the overlay only covers the header for a pointer.
+    focusStartedStream = false;
     Object.keys(cards).forEach(function (name) { setLive(cards[name], streamAll); });
   });
   // A session with nothing to show answers 503; say so rather than leaving a broken-image icon.

package/dist/engine/oracles.js

@@ -243,6 +243,14 @@ export class OracleMonitor {
     noteContradiction(c, url) {
         this.record({ kind: c.kind, severity: "high", detail: c.detail, url });
     }
+    /**
+     * The page posted a token-shaped value with targetOrigin "*" (postmessage.ts).
+     * Reported through the capture script's binding, not a page event. `embed`
+     * is the receiving frame's site when that frame is another site's.
+     */
+    noteTokenPost(detail, url, embed) {
+        this.record({ kind: "postmessage_token", severity: "high", detail, url, embed: embed ?? undefined });
+    }
     record(v) {
         if (isPolicyInduced(v, this.lastPolicyBlockAt === null ? null : Date.now() - this.lastPolicyBlockAt)) {
             this.policyAttributed += 1;