scenescout 3.15.0 → 3.17.0

package/dist/engine/claims.js

@@ -99,7 +99,28 @@ const REFUSED_RE = /\b(?:refused|rejected|blocked)\b/i;
  * an error monitor, a heartbeat. Refusing one says nothing about whether the
  * change the user made was kept, so it is never paired with a success claim.
  */
-export const INFRASTRUCTURE_WRITE_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/telemetry|\/analytics|\/heartbeat|\/sentry|\/collect\b|\/logs?\b|\/metrics\b/i;
+export const INFRASTRUCTURE_WRITE_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/telemetry|\/analytics|\/heartbeat|\/sentry|\/envelope\b|client[-_]?errors?\b|\/collect\b|\/logs?\b|\/metrics\b/i;
+/**
+ * Whether a request is one the action being judged did not send (see
+ * `WatchedRequest.background`).
+ *
+ * Once a click has started loading a new document, what follows is not the
+ * click's own write. Requests the old page sends as it is left (a preference
+ * save on pagehide) belong to that page, and requests the new page sends as it
+ * loads (an error monitor, a visit beacon) are sent with no input on it yet.
+ * Neither is answered by anything on screen, and the new page's text is all
+ * new against the old page's, so paired they read every static "Completed" as
+ * a false success. The click's own writes come before the navigation starts:
+ * a script's save awaited before it moves the page, or the navigation itself
+ * when it is a native form post.
+ */
+export function isBackgroundRequest(t) {
+    if (t.inputSince === null || t.inputSince < t.actionStartedAt || t.started < t.inputSince)
+        return true;
+    if (t.isDocumentLoad)
+        return false;
+    return t.documentLoadSince !== null && t.started > t.documentLoadSince;
+}
 /** Whether a piece of announced text explains a refusal. */
 export function isRefusalNotice(text) {
     const trimmed = text.trim();
@@ -167,7 +188,7 @@ function admitsInAnnouncement(text) {
  * "Published", a heading, a row from earlier. Only what the action put up can
  * contradict what the action's write met. Without it, every text counts.
  */
-export function findContradictions(requests, page, before) {
+export function findContradictions(requests, page, before, acted) {
     const refused = requests.filter(isRefused);
     if (refused.length === 0)
         return [];
@@ -233,8 +254,140 @@ export function findContradictions(requests, page, before) {
             });
         }
     }
+    // No success word, but the control or a counter beside it shows the change
+    // as kept: an optimistic UI telling the same falsehood without words.
+    // Medium: the page never said "saved", and a reader may still notice a
+    // reload putting the old value back.
+    const change = acted && writes.length > 0 && kept.length === 0 && successAt < 0 ? keptChange(acted.before, acted.after) : null;
+    if (change) {
+        const worst = writes[0];
+        out.push({
+            kind: "false_success",
+            severity: "medium",
+            detail: `${say(worst)} was refused, and the page shows the change as kept (${change}) with no error. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
+            evidence: `false-success-kept ${say(worst)}`,
+        });
+    }
     return out;
 }
+/** A counter: "1/3", "2 of 5", "40%". Not a date ("10/02/2026") nor a part of a longer number. */
+export const COUNTER_RE = /(?<![\d/.,:])(?:\d{1,4} ?(?:\/|of) ?\d{1,4}|\d{1,3} ?%)(?![\d/.,:])/i;
+/** The containers a counter must share with the control to count as its counter. */
+const CONTROL_CONTAINER_SEL = 'dialog, [role="dialog"], [role="alertdialog"], fieldset, form, [role="group"], [role="radiogroup"], [role="toolbar"], [role="region"], section, aside, [role="complementary"]';
+/** Most counters read for one control. */
+export const MAX_COUNTERS = 20;
+/**
+ * Page-side reader of an acted-on control: `(${ACTED_CONTROL_SRC})(node)`
+ * returns an ActedControl, or null for no node. A label stands for the box it
+ * labels. Shipped as a string for the same reason CLAIM_SCAN_SCRIPT is.
+ */
+export const ACTED_CONTROL_SRC = `(node) => {
+  if (!node) return null;
+  const visible = ${VISIBLE_SRC};
+  const box = (n) => n && n.tagName === "INPUT" && (n.type === "checkbox" || n.type === "radio");
+  const control = node.control || (box(node) ? node : node.querySelector && node.querySelector("input[type=checkbox], input[type=radio]")) || node;
+  const flag = (v) => (v === "true" ? true : v === "false" ? false : null);
+  const role = control.getAttribute("role") || (box(control) ? control.type : control.tagName.toLowerCase());
+  const counter = ${COUNTER_RE};
+  const counters = [];
+  const add = (t) => {
+    const text = (t || "").replace(/\\s+/g, " ").trim();
+    if (text && text.length <= 60 && counter.test(text) && !counters.includes(text) && counters.length < ${MAX_COUNTERS}) counters.push(text);
+  };
+  const near = control.closest(${JSON.stringify(CONTROL_CONTAINER_SEL)}) || (control.parentElement && control.parentElement.parentElement);
+  if (near) {
+    const walker = document.createTreeWalker(near, NodeFilter.SHOW_ELEMENT);
+    for (let el = near; el && counters.length < ${MAX_COUNTERS}; el = walker.nextNode()) {
+      let own = "";
+      for (const child of el.childNodes) if (child.nodeType === 3) own += child.nodeValue;
+      if (own.trim() && visible(el)) add(own);
+    }
+  }
+  for (const region of document.querySelectorAll("[role~='status'], [role~='alert'], [aria-live]:not([aria-live='off']), output")) {
+    if (visible(region)) add(region.innerText);
+  }
+  return {
+    role,
+    checked: box(control) ? control.checked : flag(control.getAttribute("aria-checked")),
+    pressed: flag(control.getAttribute("aria-pressed")),
+    selected: flag(control.getAttribute("aria-selected")),
+    counters,
+  };
+}`;
+/**
+ * How the acted-on control shows its change as kept, or null when it does not.
+ *
+ * A checked, pressed or selected state that moved is the change itself (a
+ * tab's selection is not: choosing a tab is moving around, not a change the
+ * user asked to keep). A counter beside it that moved ("0/3" to "1/3
+ * completed") counts it as done. A counter that merely appeared does not: a
+ * step that opens with "Step 1 of 3" counts nothing yet.
+ */
+export function keptChange(before, after) {
+    for (const state of ["checked", "pressed", "selected"]) {
+        if (state === "selected" && after.role === "tab")
+            continue;
+        const was = before[state];
+        const now = after[state];
+        if (was !== null && now !== null && was !== now)
+            return `the control is now ${now ? state : `not ${state}`}`;
+    }
+    const gone = before.counters.filter((c) => !after.counters.includes(c));
+    const fresh = after.counters.filter((c) => !before.counters.includes(c));
+    if (gone.length > 0 && fresh.length > 0)
+        return `${JSON.stringify(gone[0])} became ${JSON.stringify(fresh[0])}`;
+    return null;
+}
+/**
+ * Whether a submit-shaped click that sent no request was answered on the page
+ * anyway, judged from the page as the click began and as it settled.
+ *
+ * - A dialog opened: a step (a confirmation), not a submit.
+ * - A field became invalid, or the page announced something new that is not
+ *   a success claim: client-side validation said what was wrong, and no
+ *   request was expected. A new "Saved!" is the opposite, the very case the
+ *   silent-submit note is for, so it never counts.
+ *
+ * Null when either reading is missing or nothing visible answered.
+ */
+export function quietAnswer(before, after) {
+    if (!before || !after)
+        return null;
+    if ((after.dialogs ?? 0) > (before.dialogs ?? 0))
+        return "dialog";
+    if ((after.invalid ?? 0) > (before.invalid ?? 0))
+        return "validation";
+    const said = new Set(before.announced ?? []);
+    if ((after.announced ?? []).some((text) => !said.has(text) && classify(text) !== "success"))
+        return "validation";
+    return null;
+}
+/**
+ * Whether a piece of announced text (an alert's or a live region's name, as
+ * the snapshot lists it) was not on the page at `baseline`. The name may be a
+ * region's sentences run together and cut short, so it is matched by prefix
+ * either way against the baseline's texts and announced sentences. False
+ * when there is no baseline: nothing says when the text arrived.
+ */
+export function saidSince(text, baseline) {
+    if (!baseline)
+        return false;
+    const norm = (t) => t.replace(/\s+/g, " ").trim();
+    const said = norm(text);
+    if (!said)
+        return false;
+    for (const earlier of [...baseline.texts, ...(baseline.announced ?? [])]) {
+        const e = norm(earlier);
+        if (!e)
+            continue;
+        if (e === said)
+            return false;
+        const shorter = Math.min(e.length, said.length);
+        if (shorter >= 20 && (e.startsWith(said) || said.startsWith(e)))
+            return false;
+    }
+    return true;
+}
 /** Most announced regions read from one page. */
 export const MAX_ANNOUNCED = 40;
 /** Most pieces of text read from one page. A page with more than this has nothing useful to say in the extra ones. */
@@ -310,6 +463,9 @@ export const CLAIM_SCAN_SCRIPT = `(() => {
   // confirmation a router cancelled a route change for (oracles.ts).
   let dialogs = 0;
   for (const d of document.querySelectorAll(${JSON.stringify(DIALOG_SEL)})) if (visible(d)) dialogs += 1;
+  // Fields the page marked invalid, so a submit answered by validation is not called silent.
+  let invalid = 0;
+  for (const f of document.querySelectorAll('[aria-invalid="true"]')) if (visible(f)) invalid += 1;
 
-  return { texts, announced, emptyLists, dialogs };
+  return { texts, announced, emptyLists, dialogs, invalid };
 })()`;