scenescout 3.14.1 → 3.16.0

package/dist/engine/claims.js

@@ -86,6 +86,41 @@ const ERROR_RE = /\b(?:error|failed|failure|could ?n[o'’]?t|unable to|went wro
  * unreported because the Danger zone said "This cannot be undone."
  */
 const REFUSAL_RE = /\b(?:can(?:not|[’'`]?t| not)|must be|(?:is|are) already|only (?:an? |the )?\w+(?: \w+)? (?:can|may|be)|may only|can only(?: be)?|(?:nothing|not) (?:was|has been|have been|been) (?:saved|sent|deleted|updated|created|changed|submitted)|(?:was|were|has|have|is|are)(?: not|n[’']t)(?: been)? (?:saved|sent|deleted|updated|created|changed|submitted))\b/i;
+/**
+ * Words that name a refusal outright. An admission when the page ANNOUNCES them
+ * or puts them up in answer to the action, as when a toast echoes the server's
+ * "was refused" message. Not page-wide: "Rejected" and "Blocked" are ordinary
+ * status badges and filter tabs on record pages, and counted wherever they
+ * stood they would excuse every lie on such a page.
+ */
+const REFUSED_RE = /\b(?:refused|rejected|blocked)\b/i;
+/**
+ * Addresses of a page's own infrastructure writes: a token refresh, telemetry,
+ * an error monitor, a heartbeat. Refusing one says nothing about whether the
+ * change the user made was kept, so it is never paired with a success claim.
+ */
+export const INFRASTRUCTURE_WRITE_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/telemetry|\/analytics|\/heartbeat|\/sentry|\/envelope\b|client[-_]?errors?\b|\/collect\b|\/logs?\b|\/metrics\b/i;
+/**
+ * Whether a request is one the action being judged did not send (see
+ * `WatchedRequest.background`).
+ *
+ * Once a click has started loading a new document, what follows is not the
+ * click's own write. Requests the old page sends as it is left (a preference
+ * save on pagehide) belong to that page, and requests the new page sends as it
+ * loads (an error monitor, a visit beacon) are sent with no input on it yet.
+ * Neither is answered by anything on screen, and the new page's text is all
+ * new against the old page's, so paired they read every static "Completed" as
+ * a false success. The click's own writes come before the navigation starts:
+ * a script's save awaited before it moves the page, or the navigation itself
+ * when it is a native form post.
+ */
+export function isBackgroundRequest(t) {
+    if (t.inputSince === null || t.inputSince < t.actionStartedAt || t.started < t.inputSince)
+        return true;
+    if (t.isDocumentLoad)
+        return false;
+    return t.documentLoadSince !== null && t.started > t.documentLoadSince;
+}
 /** Whether a piece of announced text explains a refusal. */
 export function isRefusalNotice(text) {
     const trimmed = text.trim();
@@ -110,6 +145,15 @@ export function classify(text) {
         return "empty";
     return null;
 }
+/** What counts as an open dialog: a native one or an ARIA one. */
+const DIALOG_SEL = 'dialog[open], [role="dialog"], [role="alertdialog"]';
+/** Page-side count of the open dialogs alone, for a caller that needs nothing else the claim scan reads. */
+export const OPEN_DIALOGS_SCRIPT = `(() => {
+  const visible = ${VISIBLE_SRC};
+  let dialogs = 0;
+  for (const d of document.querySelectorAll(${JSON.stringify(DIALOG_SEL)})) if (visible(d)) dialogs += 1;
+  return dialogs;
+})()`;
 function shortUrl(url) {
     try {
         const u = new URL(url);
@@ -128,25 +172,42 @@ function standIn(req) {
         ? ` The refusal was the write policy's stand-in (the server never received the request); what failed is the page's handling of a refusal, which a real one would meet the same way.`
         : "";
 }
+/** Whether an announced sentence admits the failure: an error, a refusal named outright, or one explained in the app's own words. */
+function admitsInAnnouncement(text) {
+    return classify(text) === "error" || REFUSED_RE.test(text) || isRefusalNotice(text);
+}
 /**
  * The contradictions this action produced, if any.
  *
  * Both rules are silent whenever the page admits the failure, and both require
  * a genuinely refused request — the page half never fires alone.
+ *
+ * `before` is what the page said when the action began, when the action was
+ * the user's (a click, a keypress, typing). A success claim already on screen
+ * then is not the page's answer to this action's write: a status badge reading
+ * "Published", a heading, a row from earlier. Only what the action put up can
+ * contradict what the action's write met. Without it, every text counts.
  */
-export function findContradictions(requests, page) {
+export function findContradictions(requests, page, before, acted) {
     const refused = requests.filter(isRefused);
     if (refused.length === 0)
         return [];
     const claims = page.texts.map(classify);
+    const earlier = before ? new Set([...before.texts, ...(before.announced ?? [])]) : null;
+    const isNew = (text) => earlier === null || !earlier.has(text);
     // An app that says what went wrong has behaved correctly, and nothing below
     // applies. This is checked before anything else so that a page carrying both
     // an error banner and a stale empty state is not reported.
     if (claims.includes("error"))
         return [];
-    // A refusal explained in the app's own words, where the page announces its
-    // responses. Help text with the same wording elsewhere excuses nothing.
-    if ((page.announced ?? []).some(isRefusalNotice))
+    // An admission where the page announces its responses: an error, a refusal
+    // named outright (an app echoing the server's "was refused"), or one
+    // explained in the app's own words. Help text with the same wording
+    // elsewhere excuses nothing.
+    if ((page.announced ?? []).some(admitsInAnnouncement))
+        return [];
+    // A refusal named outright in text the action put up, announced or not.
+    if (earlier !== null && page.texts.some((t) => isNew(t) && t.length <= CLAIM_TEXT_MAX && REFUSED_RE.test(t)))
         return [];
     const out = [];
     const reads = refused.filter((r) => !WRITING_METHODS.has(r.method.toUpperCase()));
@@ -162,18 +223,171 @@ export function findContradictions(requests, page) {
             evidence: `refused-empty ${say(worst)}`,
         });
     }
-    const writes = refused.filter((r) => WRITING_METHODS.has(r.method.toUpperCase()));
-    if (writes.length > 0 && claims.includes("success")) {
+    // Only writes this action sent, and not the page's own infrastructure.
+    const isActionWrite = (r) => WRITING_METHODS.has(r.method.toUpperCase()) && !r.background && !INFRASTRUCTURE_WRITE_RE.test(r.url);
+    const writes = refused.filter(isActionWrite);
+    // Writes of the same action that went through. The message may be about
+    // one of them, so a success claim beside them is a PARTIAL false success:
+    // part of the user's change was refused and the page said nothing about
+    // that part. Still reported, at medium, because silent partial loss is a
+    // real defect; all refused stays high.
+    const kept = requests.filter((r) => isActionWrite(r) && DATA_RESOURCES.has(r.resourceType) && !r.blockedByPolicy && r.status !== null && r.status < 400);
+    const successAt = claims.findIndex((c, i) => c === "success" && isNew(page.texts[i]));
+    if (writes.length > 0 && successAt >= 0) {
+        const worst = writes[0];
+        const message = JSON.stringify(page.texts[successAt].trim().slice(0, 80));
+        if (kept.length === 0) {
+            out.push({
+                kind: "false_success",
+                detail: `${say(worst)} was refused, and the page says ${message}. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
+                evidence: `false-success ${say(worst)}`,
+            });
+        }
+        else {
+            const total = writes.length + kept.length;
+            out.push({
+                kind: "false_success",
+                severity: "medium",
+                detail: `partial: ${writes.length} of ${total} writes from this action were refused (${say(worst)}), and the page says ${message} with no word about the refused part. ` +
+                    `The user is told their change was kept when part of it was rejected.${standIn(worst)}`,
+                evidence: `false-success-partial ${say(worst)}`,
+            });
+        }
+    }
+    // No success word, but the control or a counter beside it shows the change
+    // as kept: an optimistic UI telling the same falsehood without words.
+    // Medium: the page never said "saved", and a reader may still notice a
+    // reload putting the old value back.
+    const change = acted && writes.length > 0 && kept.length === 0 && successAt < 0 ? keptChange(acted.before, acted.after) : null;
+    if (change) {
         const worst = writes[0];
-        const message = page.texts[claims.indexOf("success")];
         out.push({
             kind: "false_success",
-            detail: `${say(worst)} was refused, and the page says ${JSON.stringify(message.trim().slice(0, 80))}. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
-            evidence: `false-success ${say(worst)}`,
+            severity: "medium",
+            detail: `${say(worst)} was refused, and the page shows the change as kept (${change}) with no error. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
+            evidence: `false-success-kept ${say(worst)}`,
         });
     }
     return out;
 }
+/** A counter: "1/3", "2 of 5", "40%". Not a date ("10/02/2026") nor a part of a longer number. */
+export const COUNTER_RE = /(?<![\d/.,:])(?:\d{1,4} ?(?:\/|of) ?\d{1,4}|\d{1,3} ?%)(?![\d/.,:])/i;
+/** The containers a counter must share with the control to count as its counter. */
+const CONTROL_CONTAINER_SEL = 'dialog, [role="dialog"], [role="alertdialog"], fieldset, form, [role="group"], [role="radiogroup"], [role="toolbar"], [role="region"], section, aside, [role="complementary"]';
+/** Most counters read for one control. */
+export const MAX_COUNTERS = 20;
+/**
+ * Page-side reader of an acted-on control: `(${ACTED_CONTROL_SRC})(node)`
+ * returns an ActedControl, or null for no node. A label stands for the box it
+ * labels. Shipped as a string for the same reason CLAIM_SCAN_SCRIPT is.
+ */
+export const ACTED_CONTROL_SRC = `(node) => {
+  if (!node) return null;
+  const visible = ${VISIBLE_SRC};
+  const box = (n) => n && n.tagName === "INPUT" && (n.type === "checkbox" || n.type === "radio");
+  const control = node.control || (box(node) ? node : node.querySelector && node.querySelector("input[type=checkbox], input[type=radio]")) || node;
+  const flag = (v) => (v === "true" ? true : v === "false" ? false : null);
+  const role = control.getAttribute("role") || (box(control) ? control.type : control.tagName.toLowerCase());
+  const counter = ${COUNTER_RE};
+  const counters = [];
+  const add = (t) => {
+    const text = (t || "").replace(/\\s+/g, " ").trim();
+    if (text && text.length <= 60 && counter.test(text) && !counters.includes(text) && counters.length < ${MAX_COUNTERS}) counters.push(text);
+  };
+  const near = control.closest(${JSON.stringify(CONTROL_CONTAINER_SEL)}) || (control.parentElement && control.parentElement.parentElement);
+  if (near) {
+    const walker = document.createTreeWalker(near, NodeFilter.SHOW_ELEMENT);
+    for (let el = near; el && counters.length < ${MAX_COUNTERS}; el = walker.nextNode()) {
+      let own = "";
+      for (const child of el.childNodes) if (child.nodeType === 3) own += child.nodeValue;
+      if (own.trim() && visible(el)) add(own);
+    }
+  }
+  for (const region of document.querySelectorAll("[role~='status'], [role~='alert'], [aria-live]:not([aria-live='off']), output")) {
+    if (visible(region)) add(region.innerText);
+  }
+  return {
+    role,
+    checked: box(control) ? control.checked : flag(control.getAttribute("aria-checked")),
+    pressed: flag(control.getAttribute("aria-pressed")),
+    selected: flag(control.getAttribute("aria-selected")),
+    counters,
+  };
+}`;
+/**
+ * How the acted-on control shows its change as kept, or null when it does not.
+ *
+ * A checked, pressed or selected state that moved is the change itself (a
+ * tab's selection is not: choosing a tab is moving around, not a change the
+ * user asked to keep). A counter beside it that moved ("0/3" to "1/3
+ * completed") counts it as done. A counter that merely appeared does not: a
+ * step that opens with "Step 1 of 3" counts nothing yet.
+ */
+export function keptChange(before, after) {
+    for (const state of ["checked", "pressed", "selected"]) {
+        if (state === "selected" && after.role === "tab")
+            continue;
+        const was = before[state];
+        const now = after[state];
+        if (was !== null && now !== null && was !== now)
+            return `the control is now ${now ? state : `not ${state}`}`;
+    }
+    const gone = before.counters.filter((c) => !after.counters.includes(c));
+    const fresh = after.counters.filter((c) => !before.counters.includes(c));
+    if (gone.length > 0 && fresh.length > 0)
+        return `${JSON.stringify(gone[0])} became ${JSON.stringify(fresh[0])}`;
+    return null;
+}
+/**
+ * Whether a submit-shaped click that sent no request was answered on the page
+ * anyway, judged from the page as the click began and as it settled.
+ *
+ * - A dialog opened: a step (a confirmation), not a submit.
+ * - A field became invalid, or the page announced something new that is not
+ *   a success claim: client-side validation said what was wrong, and no
+ *   request was expected. A new "Saved!" is the opposite, the very case the
+ *   silent-submit note is for, so it never counts.
+ *
+ * Null when either reading is missing or nothing visible answered.
+ */
+export function quietAnswer(before, after) {
+    if (!before || !after)
+        return null;
+    if ((after.dialogs ?? 0) > (before.dialogs ?? 0))
+        return "dialog";
+    if ((after.invalid ?? 0) > (before.invalid ?? 0))
+        return "validation";
+    const said = new Set(before.announced ?? []);
+    if ((after.announced ?? []).some((text) => !said.has(text) && classify(text) !== "success"))
+        return "validation";
+    return null;
+}
+/**
+ * Whether a piece of announced text (an alert's or a live region's name, as
+ * the snapshot lists it) was not on the page at `baseline`. The name may be a
+ * region's sentences run together and cut short, so it is matched by prefix
+ * either way against the baseline's texts and announced sentences. False
+ * when there is no baseline: nothing says when the text arrived.
+ */
+export function saidSince(text, baseline) {
+    if (!baseline)
+        return false;
+    const norm = (t) => t.replace(/\s+/g, " ").trim();
+    const said = norm(text);
+    if (!said)
+        return false;
+    for (const earlier of [...baseline.texts, ...(baseline.announced ?? [])]) {
+        const e = norm(earlier);
+        if (!e)
+            continue;
+        if (e === said)
+            return false;
+        const shorter = Math.min(e.length, said.length);
+        if (shorter >= 20 && (e.startsWith(said) || said.startsWith(e)))
+            return false;
+    }
+    return true;
+}
 /** Most announced regions read from one page. */
 export const MAX_ANNOUNCED = 40;
 /** Most pieces of text read from one page. A page with more than this has nothing useful to say in the extra ones. */
@@ -200,6 +414,7 @@ export const CLAIM_SCAN_SCRIPT = `(() => {
   // is a container of static text (its form's help, its warning), and counting
   // it brought back the help text this set exists to exclude.
   const ANNOUNCES = "[role~='status'], [role~='alert'], [aria-live]:not([aria-live='off']), output";
+  const COLUMN_HEADER = "th, [role~='columnheader'], [aria-sort]";
   const seen = new Set();
   const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_ELEMENT);
   let el = document.body;
@@ -207,7 +422,8 @@ export const CLAIM_SCAN_SCRIPT = `(() => {
     let own = "";
     for (const node of el.childNodes) if (node.nodeType === 3) own += node.nodeValue;
     own = own.replace(/\\s+/g, " ").trim();
-    if (own && own.length <= ${CLAIM_TEXT_MAX} && !seen.has(own) && visible(el)) {
+    // A column header names what a column holds ("Updated on", "Completed"); it claims nothing.
+    if (own && own.length <= ${CLAIM_TEXT_MAX} && !seen.has(own) && !el.closest(COLUMN_HEADER) && visible(el)) {
       seen.add(own);
       texts.push(own);
     }
@@ -243,7 +459,13 @@ export const CLAIM_SCAN_SCRIPT = `(() => {
       if (s && s.length <= ${CLAIM_TEXT_MAX} && !announced.includes(s)) announced.push(s);
     }
   }
+  // Open dialogs, so a page error raised as one opens can be read as the
+  // confirmation a router cancelled a route change for (oracles.ts).
+  let dialogs = 0;
+  for (const d of document.querySelectorAll(${JSON.stringify(DIALOG_SEL)})) if (visible(d)) dialogs += 1;
+  // Fields the page marked invalid, so a submit answered by validation is not called silent.
+  let invalid = 0;
+  for (const f of document.querySelectorAll('[aria-invalid="true"]')) if (visible(f)) invalid += 1;
 
-
-  return { texts, announced, emptyLists };
+  return { texts, announced, emptyLists, dialogs, invalid };
 })()`;