scenescout 3.13.0 → 3.14.0

package/dist/engine/png.js

@@ -0,0 +1,238 @@
+/**
+ * PNG in and out, and a pixel diff of two pictures, with nothing but
+ * node:zlib. A `/scenescout qa compare` reply shows an element before and
+ * after with the changed pixels highlighted; the pictures are browser
+ * screenshots, so this reads what a browser writes (8 bits a channel, not
+ * interlaced) and writes plain RGBA. Kept free of Playwright and of any
+ * image package so it is table-tested on pictures built in the test, and so
+ * the npm package gains no dependency for a feature few runs use.
+ */
+import { deflateSync, inflateSync } from "node:zlib";
+const SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+/** Channels a pixel has, by PNG colour type: grey, RGB, grey and alpha, RGBA. Palette images are not read. */
+const CHANNELS = { 0: 1, 2: 3, 4: 2, 6: 4 };
+/** The largest picture read or diffed, in pixels. An element's capture is far smaller; this bounds the memory a bad file can ask for. */
+export const MAX_PIXELS = 40_000_000;
+const CRC_TABLE = (() => {
+    const t = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        t[n] = c >>> 0;
+    }
+    return t;
+})();
+function crc32(buf) {
+    let c = 0xffffffff;
+    for (let i = 0; i < buf.length; i++)
+        c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
+    return (c ^ 0xffffffff) >>> 0;
+}
+/** Whether these bytes start the way every PNG does. */
+export function isPng(buf) {
+    return buf.length >= SIGNATURE.length && SIGNATURE.every((b, i) => buf[i] === b);
+}
+function paeth(a, b, c) {
+    const p = a + b - c;
+    const pa = Math.abs(p - a);
+    const pb = Math.abs(p - b);
+    const pc = Math.abs(p - c);
+    return pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
+}
+/** Reads a PNG into RGBA. Throws, saying why, on anything it does not read: a palette, 16-bit channels, interlacing, a bad checksum. */
+export function decodePng(buf) {
+    if (!isPng(buf))
+        throw new Error("not a PNG");
+    const view = Buffer.from(buf.buffer, buf.byteOffset, buf.byteLength);
+    let pos = SIGNATURE.length;
+    let width = 0;
+    let height = 0;
+    let colorType = -1;
+    const idat = [];
+    let ended = false;
+    while (pos + 8 <= view.length) {
+        const length = view.readUInt32BE(pos);
+        const type = view.toString("latin1", pos + 4, pos + 8);
+        if (pos + 12 + length > view.length)
+            throw new Error(`the PNG is cut short in its ${type} chunk`);
+        const body = view.subarray(pos + 8, pos + 8 + length);
+        if (crc32(view.subarray(pos + 4, pos + 8 + length)) !== view.readUInt32BE(pos + 8 + length))
+            throw new Error(`the PNG's ${type} chunk fails its checksum`);
+        if (type === "IHDR") {
+            width = body.readUInt32BE(0);
+            height = body.readUInt32BE(4);
+            const depth = body[8];
+            colorType = body[9];
+            if (depth !== 8)
+                throw new Error(`a PNG with ${depth}-bit channels is not read, only 8-bit`);
+            if (!(colorType in CHANNELS))
+                throw new Error(`a PNG of colour type ${colorType} is not read (palette images are not)`);
+            if (body[12] !== 0)
+                throw new Error("an interlaced PNG is not read");
+        }
+        else if (type === "IDAT")
+            idat.push(body);
+        else if (type === "IEND") {
+            ended = true;
+            break;
+        }
+        pos += 12 + length;
+    }
+    if (!ended || colorType < 0)
+        throw new Error("the PNG has no header or no end");
+    if (width === 0 || height === 0 || width * height > MAX_PIXELS)
+        throw new Error(`a ${width}×${height} PNG is outside what is read`);
+    const channels = CHANNELS[colorType];
+    const stride = width * channels;
+    let raw;
+    try {
+        // Bounded by what the header promises, so a small file cannot inflate into gigabytes.
+        raw = inflateSync(Buffer.concat(idat), { maxOutputLength: height * (stride + 1) + 1 });
+    }
+    catch (err) {
+        throw new Error(`the PNG's pixel data does not inflate to the size its header gives (${err instanceof Error ? err.message : String(err)})`);
+    }
+    if (raw.length !== height * (stride + 1))
+        throw new Error("the PNG's pixel data is not the size its header gives");
+    const rows = new Uint8Array(height * stride);
+    for (let y = 0; y < height; y++) {
+        const filter = raw[y * (stride + 1)];
+        const src = y * (stride + 1) + 1;
+        const out = y * stride;
+        for (let x = 0; x < stride; x++) {
+            const left = x >= channels ? rows[out + x - channels] : 0;
+            const up = y > 0 ? rows[out - stride + x] : 0;
+            const upLeft = y > 0 && x >= channels ? rows[out - stride + x - channels] : 0;
+            const v = raw[src + x];
+            let r;
+            if (filter === 0)
+                r = v;
+            else if (filter === 1)
+                r = v + left;
+            else if (filter === 2)
+                r = v + up;
+            else if (filter === 3)
+                r = v + ((left + up) >> 1);
+            else if (filter === 4)
+                r = v + paeth(left, up, upLeft);
+            else
+                throw new Error(`the PNG uses row filter ${filter}, which does not exist`);
+            rows[out + x] = r & 0xff;
+        }
+    }
+    if (channels === 4)
+        return { width, height, data: rows };
+    const data = new Uint8Array(width * height * 4);
+    for (let i = 0, j = 0; i < width * height; i++, j += channels) {
+        const grey = channels <= 2;
+        data[i * 4] = rows[j];
+        data[i * 4 + 1] = grey ? rows[j] : rows[j + 1];
+        data[i * 4 + 2] = grey ? rows[j] : rows[j + 2];
+        data[i * 4 + 3] = channels === 2 ? rows[j + 1] : channels === 4 ? rows[j + 3] : 255;
+    }
+    return { width, height, data };
+}
+function chunk(type, body) {
+    const head = Buffer.alloc(8);
+    head.writeUInt32BE(body.length, 0);
+    head.write(type, 4, "latin1");
+    const tail = Buffer.alloc(4);
+    tail.writeUInt32BE(crc32(Buffer.concat([head.subarray(4), body])), 0);
+    return Buffer.concat([head, body, tail]);
+}
+/** Writes RGBA as a PNG: 8-bit colour with alpha, no filtering, deflated. */
+export function encodePng(img) {
+    if (img.data.length !== img.width * img.height * 4)
+        throw new Error("the pixel data is not width × height × 4 bytes");
+    const header = Buffer.alloc(13);
+    header.writeUInt32BE(img.width, 0);
+    header.writeUInt32BE(img.height, 4);
+    header[8] = 8;
+    header[9] = 6;
+    const stride = img.width * 4;
+    const raw = Buffer.alloc(img.height * (stride + 1));
+    for (let y = 0; y < img.height; y++)
+        raw.set(img.data.subarray(y * stride, (y + 1) * stride), y * (stride + 1) + 1);
+    return Buffer.concat([SIGNATURE, chunk("IHDR", header), chunk("IDAT", deflateSync(raw)), chunk("IEND", new Uint8Array(0))]);
+}
+/**
+ * How far apart two channel values may be and the pixel still count as the
+ * same, out of 255. Two screenshots of one unchanged element in one browser
+ * match exactly; the allowance absorbs the odd colour rounded one step
+ * differently, not a change anyone would see.
+ */
+export const DIFF_THRESHOLD = 8;
+/** The colour a changed pixel is painted in the diff picture. */
+export const DIFF_HIGHLIGHT = [255, 0, 80];
+/**
+ * Compares two pictures pixel by pixel. Pictures of different sizes are laid
+ * over each other from the top-left corner, which is where an element's
+ * capture starts (its bounds plus a fixed margin), and every pixel only one of
+ * them covers counts as changed: an element that grew has changed.
+ */
+export function diffImages(before, after, threshold = DIFF_THRESHOLD) {
+    const width = Math.max(before.width, after.width);
+    const height = Math.max(before.height, after.height);
+    if (width * height > MAX_PIXELS)
+        throw new Error(`a ${width}×${height} diff is outside what is compared`);
+    const data = new Uint8Array(width * height * 4);
+    let changed = 0;
+    let minX = width;
+    let minY = height;
+    let maxX = -1;
+    let maxY = -1;
+    const at = (img, x, y) => (x < img.width && y < img.height ? (y * img.width + x) * 4 : -1);
+    for (let y = 0; y < height; y++) {
+        for (let x = 0; x < width; x++) {
+            const a = at(before, x, y);
+            const b = at(after, x, y);
+            let differs = a < 0 || b < 0;
+            if (!differs)
+                for (let c = 0; c < 4; c++)
+                    if (Math.abs(before.data[a + c] - after.data[b + c]) > threshold) {
+                        differs = true;
+                        break;
+                    }
+            const o = (y * width + x) * 4;
+            if (differs) {
+                changed++;
+                if (x < minX)
+                    minX = x;
+                if (y < minY)
+                    minY = y;
+                if (x > maxX)
+                    maxX = x;
+                if (y > maxY)
+                    maxY = y;
+                data[o] = DIFF_HIGHLIGHT[0];
+                data[o + 1] = DIFF_HIGHLIGHT[1];
+                data[o + 2] = DIFF_HIGHLIGHT[2];
+                data[o + 3] = 255;
+            }
+            else {
+                // Faded grey of the after picture, so the eye goes to the highlight and still sees where it is.
+                const lum = 0.299 * after.data[b] + 0.587 * after.data[b + 1] + 0.114 * after.data[b + 2];
+                const v = Math.round(255 - (255 - lum) * 0.3);
+                data[o] = v;
+                data[o + 1] = v;
+                data[o + 2] = v;
+                data[o + 3] = 255;
+            }
+        }
+    }
+    const total = width * height;
+    return {
+        width,
+        height,
+        changed,
+        total,
+        // Never rounded down to 0 when something changed: "0%" must mean nothing did.
+        percent: changed === 0 ? 0 : Math.max(0.01, Math.round((changed / total) * 10_000) / 100),
+        sizeChanged: before.width !== after.width || before.height !== after.height,
+        before: { width: before.width, height: before.height },
+        after: { width: after.width, height: after.height },
+        box: maxX < 0 ? null : { x: minX, y: minY, width: maxX - minX + 1, height: maxY - minY + 1 },
+        image: { width, height, data },
+    };
+}

package/dist/engine/postmessage.js

@@ -0,0 +1,282 @@
+/**
+ * The postMessage-token oracle: a page that calls `postMessage` with
+ * targetOrigin "*" and a message carrying a credential.
+ *
+ * targetOrigin is the sender's statement of who may read the message. "*"
+ * means anyone: the message is delivered to whatever document the target
+ * window holds at that moment, which may be an opener or frame that has
+ * navigated to another site, or an embed of another site to begin with. A
+ * token in such a message is handed to that site. Naming the intended origin
+ * (or "/" for the sender's own) makes the browser drop the message instead.
+ *
+ * What counts as token-shaped (`tokenShapeOf`), on any string in the message,
+ * however deeply nested, and inside a string that is itself JSON:
+ *
+ * - `jwt`: a whole value of three base64url parts whose first two begin
+ *   `eyJ` (base64 of `{"`), the header and claims of a JSON Web Token. The
+ *   signature part may be empty (an unsigned token is still a bearer
+ *   credential).
+ * - `bearer`: a whole value `Bearer <opaque>`, as an Authorization header
+ *   carries it.
+ * - `credential-key`: a value under a key that names a credential
+ *   (`CREDENTIAL_KEYS`: access_token, id_token, refresh_token, api_key and
+ *   the like, in any case and with or without `_`/`-`) that looks opaque:
+ *   20 or more URL-safe characters with at least one letter and one digit.
+ *   `token_type: "Bearer"` or `token: "pending"` is not one.
+ * - `url-param`: a string with an `access_token=`, `id_token=` or
+ *   `refresh_token=` parameter of 16 or more characters, the shape an
+ *   implicit-flow redirect URL or fragment has.
+ *
+ * The value itself is never kept or reported. A finding names the path to it
+ * inside the message (`data.auth.access_token`), its shape, and a masked
+ * preview: its first four characters and its length, which identify the
+ * token to someone who has it and give nothing to someone who does not.
+ *
+ * Capture is an init script (`postMessageCaptureScript`) that wraps
+ * `window.postMessage` in every frame and hands the engine the message's
+ * longer strings only when targetOrigin is "*". Two limits follow from how
+ * browsers work, not from a choice: a call made on a window of another origin
+ * (`iframe.contentWindow.postMessage(...)` into an embed of another site)
+ * goes through the browser's cross-origin wrapper, which no page script can
+ * replace, so it is not seen; and `MessagePort.postMessage` takes no
+ * targetOrigin, so it is out of scope. What is seen is a call on the
+ * sender's own window or on a same-origin one (an opener, a parent, a frame),
+ * which is where the "*" is written, and the defect is that line of code.
+ *
+ * No browser is needed for these rules, so they are table-tested in
+ * oracle-test; browser.ts installs the script and reports what it hands back.
+ */
+import { normalizePath } from "./fingerprint.js";
+/** The binding the capture script reports through. */
+export const POSTMESSAGE_BINDING = "__scenescoutPostMessage";
+/** Strings shorter than this are not sent to the engine: nothing token-shaped is shorter. */
+export const MIN_CANDIDATE_LENGTH = 16;
+/** Longest string sent; a JWT carrying many claims runs to a few kilobytes. */
+export const MAX_CANDIDATE_LENGTH = 8192;
+/** Longest JSON-looking string sent whole, so the engine can parse it; a longer one is cut and its contents go unread. */
+export const MAX_JSON_LENGTH = 262144;
+/** Most values the walk visits per message: a large array or a binary buffer must not stall the app's call. */
+export const MAX_VISITS = 2000;
+/** Most items read from any one array or object. */
+export const MAX_ITEMS = 200;
+/** Most strings sent per message, and the deepest nesting walked. */
+export const MAX_CANDIDATES = 50;
+export const MAX_DEPTH = 6;
+/** Whether a targetOrigin lets any origin read the message. Only "*" does; "/" is the sender's own origin. */
+export function postsToAnyOrigin(targetOrigin) {
+    return targetOrigin === "*";
+}
+/**
+ * The script run in every frame before the page's own scripts. It replaces
+ * `window.postMessage` with a wrapper that, when targetOrigin is "*", walks
+ * the message for strings of MIN_CANDIDATE_LENGTH or more and hands them,
+ * each with its path, to the binding; then it calls the original with the
+ * same arguments, whatever happened before. The walk skips binary buffers
+ * and stops after MAX_VISITS values and MAX_ITEMS entries of any one array or object, so a large message costs the app little. Both call forms are read:
+ * `postMessage(msg, origin)` and `postMessage(msg, { targetOrigin })`, whose
+ * default is "/".
+ *
+ * Failures in the wrapper are swallowed on purpose: the app's call must go
+ * through exactly as it would without SceneScout, and a capture error must
+ * never be reported as the app's own page error.
+ */
+export function postMessageCaptureScript(binding = POSTMESSAGE_BINDING) {
+    return `(() => {
+  const W = window;
+  const orig = W.postMessage;
+  if (typeof orig !== "function" || orig.__scenescoutWrapped) return;
+  const NAME = ${JSON.stringify(binding)};
+  const MIN = ${MIN_CANDIDATE_LENGTH}, LEN = ${MAX_CANDIDATE_LENGTH}, JSON_LEN = ${MAX_JSON_LENGTH}, MAX = ${MAX_CANDIDATES}, DEPTH = ${MAX_DEPTH}, VISITS = ${MAX_VISITS}, ITEMS = ${MAX_ITEMS};
+  const collect = (data) => {
+    const out = [];
+    const seen = new Set();
+    let visits = 0;
+    const walk = (v, path, depth) => {
+      if (out.length >= MAX || ++visits > VISITS) return;
+      if (typeof v === "string") {
+        if (v.length >= MIN) out.push([path, v.slice(0, /^\s*[{[]/.test(v) ? JSON_LEN : LEN)]);
+        return;
+      }
+      if (!v || typeof v !== "object" || depth >= DEPTH || seen.has(v)) return;
+      if (v instanceof ArrayBuffer || ArrayBuffer.isView(v)) return;
+      seen.add(v);
+      const isArray = Array.isArray(v);
+      let keys;
+      try { keys = isArray ? Array.from({ length: Math.min(v.length, ITEMS) }, (_, i) => i) : Object.keys(v).slice(0, ITEMS); } catch (e) { return; }
+      for (const k of keys) {
+        let child;
+        try { child = v[k]; } catch (e) { continue; }
+        walk(child, isArray ? path + "[" + k + "]" : path + "." + k, depth + 1);
+        if (out.length >= MAX) return;
+      }
+    };
+    walk(data, "data", 0);
+    return out;
+  };
+  const wrapped = function postMessage(message, targetOrigin) {
+    try {
+      const origin = typeof targetOrigin === "string"
+        ? targetOrigin
+        : targetOrigin && typeof targetOrigin === "object" && targetOrigin.targetOrigin !== undefined
+          ? String(targetOrigin.targetOrigin)
+          : "/";
+      const report = W[NAME];
+      if (origin === "*" && typeof report === "function") {
+        const found = collect(message);
+        if (found.length > 0) {
+          const sent = report(found);
+          // A report that fails must not become an unhandled rejection the page oracle files against the app.
+          if (sent && typeof sent.then === "function") sent.then(undefined, () => undefined);
+        }
+      }
+    } catch (e) {
+      // The capture is ours; the app's call below must run as it would without it.
+    }
+    return orig.apply(this, arguments);
+  };
+  Object.defineProperty(wrapped, "__scenescoutWrapped", { value: true });
+  W.postMessage = wrapped;
+})();`;
+}
+/** Key names, lower-cased with `_` and `-` removed, whose value is a credential. */
+export const CREDENTIAL_KEYS = new Set([
+    "accesstoken",
+    "idtoken",
+    "refreshtoken",
+    "authtoken",
+    "sessiontoken",
+    "bearertoken",
+    "apitoken",
+    "apikey",
+    "clientsecret",
+    "token",
+    "jwt",
+]);
+const JWT_RE = /^eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*$/;
+const BEARER_RE = /^Bearer\s+([A-Za-z0-9._~+/=-]{16,})$/i;
+const OPAQUE_RE = /^[A-Za-z0-9._~+/=-]{20,}$/;
+const URL_PARAM_RE = /(?:^|[?#&])(?:access_token|id_token|refresh_token)=([^&#\s]{16,})/;
+/** Paths are page text; cut so a hostile message cannot fill the report. */
+const MAX_PATH_LENGTH = 120;
+/** The last key of a path such as `data.auth.access_token` or `data.list[0]`. */
+function lastKey(path) {
+    const m = /(?:\.([^.[\]]+)|\[[^\]]*\])$/.exec(path);
+    return m?.[1] ?? "";
+}
+function isOpaque(value) {
+    return OPAQUE_RE.test(value) && /[A-Za-z]/.test(value) && /[0-9]/.test(value);
+}
+/** Masked preview of a credential: its first four characters and its length. Nothing past the fourth character is ever included. */
+export function maskToken(value) {
+    return `"${value.slice(0, 4)}…" (${value.length} chars)`;
+}
+/**
+ * The shape of one string at one path, with the part that is the credential
+ * (so the preview is of the token, not of a `Bearer ` prefix), or null when
+ * it is not token-shaped.
+ */
+export function tokenShapeOf(path, raw) {
+    const value = raw.trim();
+    if (JWT_RE.test(value))
+        return { shape: "jwt", secret: value };
+    const bearer = BEARER_RE.exec(value);
+    if (bearer)
+        return { shape: "bearer", secret: bearer[1] };
+    if (CREDENTIAL_KEYS.has(lastKey(path).toLowerCase().replace(/[_-]/g, "")) && isOpaque(value))
+        return { shape: "credential-key", secret: value };
+    const param = URL_PARAM_RE.exec(value);
+    if (param)
+        return { shape: "url-param", secret: param[1] };
+    return null;
+}
+/** A string message that is itself JSON (`postMessage(JSON.stringify({...}), "*")`), walked like an object would be. */
+function jsonStrings(path, value) {
+    const t = value.trim();
+    if (!(t.startsWith("{") || t.startsWith("[")))
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(t);
+    }
+    catch {
+        // Not JSON after all: the string was already judged as it is.
+        return [];
+    }
+    const out = [];
+    const walk = (v, p, depth) => {
+        if (out.length >= MAX_CANDIDATES)
+            return;
+        if (typeof v === "string") {
+            if (v.length >= MIN_CANDIDATE_LENGTH)
+                out.push([p, v]);
+            return;
+        }
+        if (!v || typeof v !== "object" || depth >= MAX_DEPTH)
+            return;
+        if (Array.isArray(v))
+            v.forEach((c, i) => walk(c, `${p}[${i}]`, depth + 1));
+        else
+            for (const [k, c] of Object.entries(v))
+                walk(c, `${p}.${k}`, depth + 1);
+    };
+    walk(parsed, `${path}(json)`, 0);
+    return out;
+}
+/**
+ * The token-shaped values among what the capture script handed back. Entries
+ * come from the page, so anything not a `[path, string]` pair is skipped.
+ * One hit per path; the values are discarded here.
+ */
+export function tokenHits(entries) {
+    if (!Array.isArray(entries))
+        return [];
+    const out = [];
+    const seen = new Set();
+    const judge = (path, value) => {
+        const found = tokenShapeOf(path, value);
+        const shown = path.slice(0, MAX_PATH_LENGTH);
+        if (!found || seen.has(shown))
+            return;
+        seen.add(shown);
+        out.push({ path: shown, shape: found.shape, preview: maskToken(found.secret) });
+    };
+    for (const entry of entries.slice(0, MAX_CANDIDATES)) {
+        // The page cuts strings itself; a page that does not (a spoofed call) is cut here to the same bounds.
+        if (!Array.isArray(entry) || typeof entry[0] !== "string" || typeof entry[1] !== "string")
+            continue;
+        const [path, raw] = entry;
+        const value = raw.slice(0, MAX_JSON_LENGTH);
+        judge(path, value);
+        for (const [p, v] of jsonStrings(path, value))
+            judge(p, v);
+    }
+    return out;
+}
+function routeOf(url) {
+    try {
+        return normalizePath(new URL(url).pathname);
+    }
+    catch {
+        return url || "?";
+    }
+}
+/** One report per route, receiving frame, path and shape, so a page that posts on every render is reported once. */
+export function tokenPostKey(hit, pageUrl, frameUrl) {
+    let frameOrigin = "";
+    try {
+        frameOrigin = new URL(frameUrl).origin;
+    }
+    catch {
+        frameOrigin = "?";
+    }
+    return `${routeOf(pageUrl)}|${frameOrigin}|${hit.path}|${hit.shape}`;
+}
+/**
+ * The violation's detail. The shape and path come first because the oracle
+ * log signs a violation on its first characters: two tokens posted by one
+ * page must not read as one.
+ */
+export function describeTokenPost(hit, frameUrl) {
+    return (`${hit.shape} token at ${hit.path} (${hit.preview}) posted with targetOrigin "*" to the window of ${routeOf(frameUrl)} — ` +
+        `any origin that window holds (an opener or frame that navigated elsewhere, another site's embed) receives the credential; name the intended origin instead`);
+}

package/dist/engine/probes.js

@@ -1,7 +1,5 @@
 import { DIALOG_LIKE_SEL } from "./collector.js";
 import { focusAdvanceKey, isBrowserEngine } from "../browsers.js";
-/** Per-action Playwright timeout, shared with the engine so a scroll into view fails as fast as a click would. */
-export const ACTION_TIMEOUT_MS = 5000;
 /**
  * Scroll ONE named region rather than the page. The page-level heuristic
  * picks the largest scrollable pane, so a smaller independently-scrolling
@@ -10,7 +8,9 @@ export const ACTION_TIMEOUT_MS = 5000;
  * away. Resolves the element, then scrolls the nearest scrollable ancestor
  * (the target itself is usually the content, not the scroll port).
  */
-export async function scrollContainer(page, target, to, by) {
+export async function scrollContainer(page, target, to, by, 
+/** The session's action limit, so a scroll into view fails as fast as a click would. */
+timeoutMs) {
     let locator;
     if (target.startsWith("testid="))
         locator = page.locator(`[data-testid=${JSON.stringify(target.slice(7))}]`).first();
@@ -48,7 +48,7 @@ export async function scrollContainer(page, target, to, by) {
             y: Math.round(node.scrollTop),
             max: Math.max(0, node.scrollHeight - node.clientHeight),
         };
-    }, { edge: to ?? null, delta: amount }, { timeout: ACTION_TIMEOUT_MS })
+    }, { edge: to ?? null, delta: amount }, { timeout: timeoutMs })
         .catch(() => undefined);
     if (outcome === undefined)
         return { refused: `Scroll target not found: ${target}`, note: "" };