scenescout 3.15.0 → 3.17.0

package/dist/engine/request.js

@@ -22,41 +22,143 @@
  * Everything in this file is pure so it can be table-tested; the one
  * `page.evaluate` lives in browser.ts.
  */
+import { redactSecrets } from "./memory.js";
 import { POLICY_REFUSAL_HEADER } from "./policy.js";
 /** Methods a session may replay. Anything else is refused before it reaches the page. */
 export const REPLAYABLE_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 /** Most of a response body that reaches the agent. A JSON list can be megabytes; the signature is in the first lines. */
 export const BODY_MAX = 2000;
+/** Most of a body one call can return when it asks for a part of it (`select`, or `offset`/`limit`). */
+export const VIEW_MAX = 8000;
+/** Most of a body the page hands back when a part of it was asked for: a select needs the whole document to parse. */
+export const BODY_FETCH_MAX = 1_000_000;
+/** Whether a view asks for anything other than the default first BODY_MAX characters. */
+export function wantsView(view) {
+    return !!view && (view.select !== undefined || view.offset !== undefined || view.limit !== undefined);
+}
+/** The steps of a select path: "a.b[0].c" and "a.b.0.c" are the same three-then-one steps. */
+export function selectSteps(select) {
+    return select
+        .trim()
+        .replace(/\[(\d+)\]/g, ".$1")
+        .split(".")
+        .filter((step) => step !== "");
+}
+/**
+ * The part of the body a view asks for, and the line that says what it is.
+ * A select parses the body as JSON and returns the value at the path,
+ * pretty-printed; a path that runs out says where and what keys were there
+ * instead. offset/limit then take a window of that text (or of the raw body
+ * with no select), and the note names the next offset when there is more.
+ */
+export function viewBody(text, full, view) {
+    let source = text;
+    let total = full;
+    let what = "the body";
+    if (view.select !== undefined) {
+        if (full > text.length) {
+            return {
+                body: "",
+                note: `select needs the whole body, and this one is ${full} characters, past the ${text.length} read. Page through it with offset and limit instead.`,
+            };
+        }
+        let value;
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            return { body: "", note: `select reads a JSON body, and this one is not JSON. Page through it with offset and limit instead.` };
+        }
+        const steps = selectSteps(view.select);
+        for (let i = 0; i < steps.length; i++) {
+            const step = steps[i];
+            const here = steps.slice(0, i).join(".") || "the top level";
+            if (Array.isArray(value)) {
+                const index = /^\d+$/.test(step) ? Number(step) : Number.NaN;
+                if (!(index < value.length))
+                    return { body: "", note: `select ${JSON.stringify(view.select)}: no item ${JSON.stringify(step)} at ${here}, which is a list of ${value.length}.` };
+                value = value[index];
+            }
+            else if (value !== null && typeof value === "object") {
+                const record = value;
+                if (!Object.prototype.hasOwnProperty.call(record, step)) {
+                    const keys = Object.keys(record);
+                    return {
+                        body: "",
+                        note: `select ${JSON.stringify(view.select)}: no key ${JSON.stringify(step)} at ${here}. Keys there: ${keys.slice(0, 40).join(", ")}${keys.length > 40 ? ` … +${keys.length - 40}` : ""}.`,
+                    };
+                }
+                value = record[step];
+            }
+            else {
+                return {
+                    body: "",
+                    note: `select ${JSON.stringify(view.select)}: ${here} is ${value === null ? "null" : typeof value}, which has no ${JSON.stringify(step)}.`,
+                };
+            }
+        }
+        source = JSON.stringify(value, null, 2) ?? "undefined";
+        total = source.length;
+        what = `select ${JSON.stringify(view.select)}`;
+    }
+    const offset = Math.max(0, Math.floor(view.offset ?? 0));
+    const limit = Math.min(VIEW_MAX, Math.max(1, Math.floor(view.limit ?? (view.select !== undefined && view.offset === undefined ? VIEW_MAX : BODY_MAX))));
+    if (offset >= total && total > 0)
+        return { body: "", note: `${what}: offset ${offset} is past its end (${total} characters).` };
+    const end = Math.min(total, offset + limit);
+    const body = source.slice(offset, end);
+    const whole = offset === 0 && end === total;
+    const note = whole
+        ? `${what}: all ${total} characters`
+        : `${what}: characters ${offset}–${end} of ${total}${end < total ? `; the next part is offset ${end}` : ""}`;
+    return { body, note };
+}
 /** Response headers worth reporting. "Identical response" means status, body AND headers, so the ones that commonly differ are kept. */
 export const REPORTED_HEADERS = ["content-type", "content-length", "location", "www-authenticate", "retry-after", "x-request-id", "cache-control"];
 /**
- * The path to call, resolved against the attached origin and fenced to it.
- * Navigation is fenced the same way: a run attached to one app must not be
- * able to make its browser talk to another host just because a path was
- * spelled as a full URL.
+ * Where a page, a crawl path, a plan step or a replayed call goes, given the
+ * URL the session was attached on. One rule for every tool:
+ *
+ * - A path resolves against the attached ORIGIN, never the attach URL's path.
+ *   `/widgets` is `/widgets` whether the session attached on `/` or on
+ *   `/things`, as URL rules and every browser read it; a bare `widgets` is
+ *   read as `/widgets` too, so the page the session happens to be on never
+ *   changes where a target goes.
+ * - A full URL on the attached origin is used as given.
+ * - Anything on another origin, or a scheme other than http(s), is refused:
+ *   a run attached to one app must not be able to make its browser talk to
+ *   another host just because a target was spelled as a full URL.
+ *
+ * `offOrigin` marks the refusal that is the fence, so a caller can word it as one.
  */
-export function resolveRequestUrl(baseUrl, path) {
-    const trimmed = path.trim();
+export function resolveTarget(attachUrl, target) {
+    const trimmed = target.trim();
     if (!trimmed)
-        return { problem: "No path given. Pass a path such as /api/things, or a full URL on the attached origin." };
-    let target;
-    let base;
+        return { problem: "No path given. Pass a path such as /api/things, or a full URL on the attached origin.", offOrigin: false };
+    let resolved;
+    let origin;
     try {
-        base = new URL(baseUrl);
-        target = new URL(trimmed, base);
+        origin = new URL(attachUrl).origin;
+        resolved = new URL(trimmed, `${origin}/`);
     }
     catch {
-        return { problem: `Could not read ${JSON.stringify(trimmed)} as a path or a URL.` };
+        return { problem: `Could not read ${JSON.stringify(trimmed)} as a path or a URL.`, offOrigin: false };
     }
-    if (target.protocol !== "http:" && target.protocol !== "https:") {
-        return { problem: `Only http and https can be requested; ${target.protocol} cannot.` };
+    if (resolved.protocol !== "http:" && resolved.protocol !== "https:") {
+        return { problem: `Only http and https can be reached; ${resolved.protocol} cannot.`, offOrigin: false };
     }
-    if (target.origin !== base.origin) {
+    if (resolved.origin !== origin) {
         return {
-            problem: `${target.origin} is not the origin this session is attached to (${base.origin}). A session talks to its own app only; attach another session to test another host.`,
+            problem: `${resolved.origin} is not the origin this session is attached to (${origin}). A session talks to its own app only; attach another session to test another host.`,
+            offOrigin: true,
         };
     }
-    return { url: target.toString() };
+    return { url: resolved.toString() };
+}
+/** The URL scout_request calls: resolveTarget's rule, so a call and a page load never disagree on where a path goes. */
+export function resolveRequestUrl(attachUrl, path) {
+    const out = resolveTarget(attachUrl, path);
+    return "url" in out ? out : { problem: out.problem };
 }
 /** The method, upper-cased, or the reason it cannot be replayed. */
 export function resolveMethod(method) {
@@ -77,6 +179,7 @@ export function resolveMethod(method) {
  */
 export function buildRequestScript(input) {
     const { url, method, body, headers } = input;
+    const keep = input.keep ?? BODY_MAX * 2;
     const init = { method, credentials: "include", headers };
     if (body !== undefined && method !== "GET" && method !== "HEAD")
         init.body = body;
@@ -84,7 +187,7 @@ export function buildRequestScript(input) {
         ` const res = await fetch(${JSON.stringify(url)}, ${JSON.stringify(init)});` +
         ` const text = await res.text();` +
         ` const headers = {}; res.headers.forEach((v, k) => { headers[k] = v; });` +
-        ` return { status: res.status, statusText: res.statusText, headers, body: text.slice(0, ${BODY_MAX * 2}), full: text.length, ms: Date.now() - started, url: res.url }; })()`);
+        ` return { status: res.status, statusText: res.statusText, headers, body: text.slice(0, ${keep}), full: text.length, ms: Date.now() - started, url: res.url }; })()`);
 }
 /** The headers to send: what the caller asked for, plus the app's own auth and a JSON content type when a body is present. */
 export function requestHeaders(input) {
@@ -99,20 +202,63 @@ export function requestHeaders(input) {
         out[name.toLowerCase()] = value;
     return out;
 }
+/**
+ * The Authorization header to remember from a request the browser is sending,
+ * or null to leave the remembered one as it is. Every request the app sends to
+ * its own origin counts, reads included: an app that rotates its access token
+ * and then only reads would otherwise leave scout_request replaying the token
+ * of its last write, long expired. A request to another origin, or one sent
+ * from a frame of another origin, is skipped, so an embedded widget's bearer
+ * token is never replayed to the app; and so is a scout_request call's own
+ * request, so a credential the caller chose for one call does not become the
+ * session's. `frameUrl` is the sending frame's address, when it has one (a
+ * worker's request has none; about:blank and the like count as the app's).
+ */
+export function authToRemember(input) {
+    if (input.replay)
+        return null;
+    try {
+        const origin = new URL(input.baseUrl).origin;
+        if (new URL(input.url).origin !== origin)
+            return null;
+        if (input.frameUrl && /^https?:/i.test(input.frameUrl) && new URL(input.frameUrl).origin !== origin)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const entry = Object.entries(input.headers).find(([name]) => name.toLowerCase() === "authorization");
+    const value = entry?.[1];
+    return value && value.trim() ? value : null;
+}
+/**
+ * A line for a replay the server answered 401 while the page's own latest
+ * authorised request to the origin succeeded: the replayed credential is the
+ * likely cause, not the server's permissions. Empty otherwise. Statuses only,
+ * never the credential.
+ */
+export function staleCredentialNote(replayStatus, sentAuth, pageLast) {
+    if (replayStatus !== 401 || !sentAuth || !pageLast || pageLast.status < 200 || pageLast.status >= 300)
+        return "";
+    return (`\n⚠ The page's own latest authorised request to this origin got ${pageLast.status}, but this call got 401: ` +
+        `the replayed credential may be stale. Load a page that calls the API, then call again before reading this as a permission or sign-in problem.`);
+}
 /** The raw result of the in-page fetch, reduced to what the agent and the report need. */
-export function toReplayResult(raw) {
+export function toReplayResult(raw, view) {
     const kept = {};
     for (const name of REPORTED_HEADERS) {
         const value = raw.headers[name];
         if (value !== undefined)
             kept[name] = value;
     }
+    const part = wantsView(view) ? viewBody(raw.body, raw.full, view) : null;
     return {
         status: raw.status,
         statusText: raw.statusText,
         headers: kept,
-        body: raw.body.slice(0, BODY_MAX),
-        truncated: raw.full > BODY_MAX,
+        body: part ? part.body : raw.body.slice(0, BODY_MAX),
+        truncated: part ? false : raw.full > BODY_MAX,
+        ...(part ? { view: part.note } : {}),
         ms: raw.ms,
         url: raw.url,
         refusedByPolicy: raw.headers[POLICY_REFUSAL_HEADER] ?? null,
@@ -147,11 +293,159 @@ export function formatReplay(method, result) {
     const headers = Object.entries(result.headers);
     if (headers.length > 0)
         lines.push(headers.map(([k, v]) => `${k}: ${v}`).join(" · "));
-    if (result.body.length > 0) {
-        lines.push("", result.body + (result.truncated ? `\n… truncated at ${BODY_MAX} characters` : ""));
+    if (result.view !== undefined) {
+        lines.push(`(${result.view})`, "", result.body.length > 0 ? result.body : "(nothing here)");
+    }
+    else if (result.body.length > 0) {
+        lines.push("", result.body +
+            (result.truncated
+                ? `\n… truncated at ${BODY_MAX} characters — pass offset:${BODY_MAX} for the next part, or select:"a.b" for one value of a JSON body`
+                : ""));
     }
     else {
         lines.push("", "(empty body)");
     }
     return lines.join("\n");
 }
+/**
+ * The data requests (fetch and XHR) the driven page made since its document
+ * loaded, newest last. A page that shows its empty state on a client-side tab
+ * switch while the API has data leaves two explanations — the list request
+ * failed, or it never ran — and only this tells them apart. A new document
+ * starts a new list; a client-side route change does not, so each entry
+ * keeps the route it was sent from. Bounded: past MAX the oldest go, and the
+ * listing says how many.
+ */
+export class PageRequests {
+    static MAX = 300;
+    loadedAt = 0;
+    loadedUrl = "";
+    entries = [];
+    dropped = 0;
+    byRequest = new WeakMap();
+    /** A new document began loading: the list starts again. */
+    loaded(url, at) {
+        this.loadedAt = at;
+        this.loadedUrl = url;
+        this.entries = [];
+        this.dropped = 0;
+    }
+    started(key, r) {
+        const entry = { method: r.method, url: r.url, route: r.route, atMs: Math.max(0, r.at - this.loadedAt) };
+        this.byRequest.set(key, entry);
+        this.entries.push(entry);
+        if (this.entries.length > PageRequests.MAX) {
+            this.entries.shift();
+            this.dropped += 1;
+        }
+    }
+    answered(key, status, at, refused) {
+        const entry = this.byRequest.get(key);
+        if (!entry || entry.status !== undefined)
+            return;
+        entry.status = status;
+        entry.ms = Math.max(0, at - this.loadedAt - entry.atMs);
+        if (refused)
+            entry.refused = true;
+    }
+    failed(key, reason, at, refused) {
+        const entry = this.byRequest.get(key);
+        if (!entry || entry.status !== undefined)
+            return;
+        entry.failed = reason || "failed";
+        entry.ms = Math.max(0, at - this.loadedAt - entry.atMs);
+        if (refused)
+            entry.refused = true;
+    }
+    /** Label the latest request to this URL as scout_request's own call. */
+    markReplay(method, url) {
+        const entry = [...this.entries].reverse().find((e) => e.method === method && e.url === url && !e.replay);
+        if (entry)
+            entry.replay = true;
+    }
+    get snapshot() {
+        return { loadedUrl: this.loadedUrl, loadedAt: this.loadedAt, entries: this.entries, dropped: this.dropped };
+    }
+}
+/** Most entries one listing prints by default, and at most. */
+export const PAGE_REQUESTS_SHOWN = 40;
+export const PAGE_REQUESTS_SHOWN_MAX = 200;
+/**
+ * Query parameters whose value is a credential by its name, whatever the
+ * value looks like: `access_token`, `client_secret`, a signed URL's
+ * `X-Amz-Signature`, a one-time `code`.
+ */
+const SECRET_PARAM_RE = /token|secret|sig(nature)?$|^sig|password|passwd|api[-_]?key|^key$|auth|credential|session|^code$|otp/i;
+/**
+ * A request's address as the listing prints it: the path on the page's
+ * origin, the whole URL elsewhere. A query parameter named like a
+ * credential has its value replaced before anything else, then the rest
+ * passes the same redaction as an oracle's violation; it is cut only after.
+ */
+export function shownUrl(url, origin) {
+    let shown = url;
+    try {
+        const u = new URL(url);
+        let hidden = 0;
+        for (const name of [...new Set(u.searchParams.keys())]) {
+            if (SECRET_PARAM_RE.test(name)) {
+                u.searchParams.set(name, "redacted");
+                hidden += 1;
+            }
+        }
+        const search = hidden > 0 ? u.search.replace(/=redacted\b/g, "=[redacted]") : u.search;
+        shown = (u.origin === origin ? "" : u.origin) + u.pathname + search;
+    }
+    catch {
+        // Not a URL we can shorten; shown whole, and redacted below.
+    }
+    const redacted = redactSecrets(shown);
+    return redacted.length > 300 ? `${redacted.slice(0, 300)}…` : redacted;
+}
+/**
+ * The listing scout_network returns: one line per request, oldest first, the
+ * newest `limit` of them, optionally only those whose address contains a
+ * string. Query values that look like credentials are redacted the way an
+ * oracle's violation is, because the listing is printed and may be quoted in
+ * a finding.
+ */
+export function formatPageRequests(log, opts) {
+    if (!log.loadedUrl)
+        return "No page has loaded in this session yet: navigate first.";
+    let origin = "";
+    let loadedRoute = log.loadedUrl;
+    try {
+        const u = new URL(log.loadedUrl);
+        origin = u.origin;
+        loadedRoute = u.pathname;
+    }
+    catch {
+        // Kept as given.
+    }
+    const limit = Math.min(PAGE_REQUESTS_SHOWN_MAX, Math.max(1, Math.floor(opts.limit ?? PAGE_REQUESTS_SHOWN)));
+    const needle = opts.contains?.trim().toLowerCase() ?? "";
+    const matching = log.entries.filter((e) => !needle || shownUrl(e.url, origin).toLowerCase().includes(needle));
+    const shown = matching.slice(-limit);
+    const ago = Math.max(0, Math.round((opts.now - log.loadedAt) / 1000));
+    const head = `DATA REQUESTS (fetch/XHR) since this page loaded — ${shownUrl(log.loadedUrl, origin)}, ${ago}s ago: ` +
+        `${matching.length}${needle ? ` matching ${JSON.stringify(opts.contains)}` : ""}` +
+        (shown.length < matching.length ? `, the newest ${shown.length} shown` : "") +
+        (log.dropped > 0 ? ` (${log.dropped} older ones no longer kept)` : "");
+    if (shown.length === 0) {
+        return `${head}.\nNone${needle ? " matching" : ""}: if the page shows data it fetched, it fetched it before this load or without fetch/XHR (a server-rendered page, a WebSocket).`;
+    }
+    const lines = shown.map((e) => {
+        const outcome = e.status !== undefined
+            ? `${e.status}${e.ms !== undefined ? ` · ${e.ms} ms` : ""}`
+            : e.failed !== undefined
+                ? `failed: ${e.failed}`
+                : "pending (no answer yet)";
+        const notes = [
+            e.refused ? "refused by the write policy, never reached the server" : "",
+            e.replay ? "sent by scout_request" : "",
+            e.route && e.route !== loadedRoute ? `on ${e.route}` : "",
+        ].filter(Boolean);
+        return `  +${(e.atMs / 1000).toFixed(1)}s ${e.method} ${shownUrl(e.url, origin)} → ${outcome}${notes.length ? ` (${notes.join("; ")})` : ""}`;
+    });
+    return [`${head}:`, ...lines].join("\n");
+}

package/dist/engine/sarif.js

@@ -0,0 +1,120 @@
+/**
+ * Where a SARIF result points. GitHub code scanning keeps a result only when
+ * its location is a file in the repository, so a result about a page of the
+ * running app cannot point at the page itself. Each result's physical
+ * location is a repository file instead, and the route travels beside it: in
+ * a logical location, in the result's properties and in its message.
+ *
+ *  - An issue a saved flow raised points at that flow's file.
+ *  - Anything else points at the anchor: --sarif-file-anchor when given, else
+ *    the workflow file that is running (GITHUB_WORKFLOW_REF), else
+ *    package.json when the repository has one, else README.md.
+ *
+ * Paths are relative to the repository root: GITHUB_WORKSPACE when it is set,
+ * else the project directory. Pure, so check-test can table-test it.
+ */
+import path from "node:path";
+/** The anchors tried, in order, when there is no option and no workflow. */
+export const SARIF_ANCHOR_FALLBACKS = ["package.json", "README.md"];
+/** A repository-relative path with forward slashes, or an error: what --sarif-file-anchor accepts. */
+export function checkSarifAnchor(raw) {
+    const value = raw
+        .trim()
+        .replace(/\\/g, "/")
+        .replace(/^(\.\/)+/, "");
+    if (!value)
+        return { ok: false, error: "--sarif-file-anchor needs a file, relative to the repository root" };
+    if (value.startsWith("/") || /^[A-Za-z]:\//.test(value))
+        return { ok: false, error: "--sarif-file-anchor is a path relative to the repository root, not an absolute path" };
+    const parts = value.split("/");
+    if (parts.includes(".."))
+        return { ok: false, error: "--sarif-file-anchor must stay inside the repository: no .. in the path" };
+    if (value.endsWith("/"))
+        return { ok: false, error: "--sarif-file-anchor names a file, not a directory" };
+    return { ok: true, value: parts.filter((p) => p !== "." && p !== "").join("/") };
+}
+/**
+ * The workflow file in GITHUB_WORKFLOW_REF (`owner/repo/.github/workflows/x.yml@refs/heads/main`),
+ * or null when the variable is unset or is not of that shape.
+ */
+export function workflowFileOf(ref) {
+    if (!ref)
+        return null;
+    const parts = ref.split("/");
+    if (parts.length < 3 || !parts[0] || !parts[1])
+        return null;
+    // The ref after the first "@" may hold "@" itself (a branch named fix@2); the workflow's path comes before it.
+    const rest = parts.slice(2).join("/");
+    const at = rest.indexOf("@");
+    const file = at >= 0 ? rest.slice(0, at) : rest;
+    return checkSarifAnchor(file).ok ? file : null;
+}
+/**
+ * The anchor file, where it came from, and a warning when the file it should
+ * have been is not in the repository. Candidates are tried in order: the
+ * option, the workflow file, then each fallback; the first that exists wins.
+ * When none does, the first candidate is kept so the SARIF is still written,
+ * and the warning says code scanning will drop its results.
+ * `exists` is asked about repository-relative paths.
+ */
+export function resolveSarifAnchor(o) {
+    const workflow = workflowFileOf(o.env.GITHUB_WORKFLOW_REF);
+    const candidates = [
+        ...(o.option !== undefined ? [{ file: o.option, source: "option" }] : []),
+        ...(workflow ? [{ file: workflow, source: "workflow" }] : []),
+        ...SARIF_ANCHOR_FALLBACKS.map((file) => ({ file, source: "fallback" })),
+    ];
+    const describe = (c) => c.source === "option" ? `--sarif-file-anchor ${c.file}` : c.source === "workflow" ? `the workflow file ${c.file}` : c.file;
+    const chosen = candidates.find((c) => o.exists(c.file));
+    // Fallbacks are tried quietly; only a file that was asked for, or the workflow running, is missed out loud.
+    const missed = candidates.slice(0, chosen ? candidates.indexOf(chosen) : candidates.length).filter((c) => c.source !== "fallback");
+    if (!chosen) {
+        const first = candidates[0];
+        return {
+            ...first,
+            warning: `SARIF: no anchor file exists in the repository (tried ${candidates.map(describe).join(", ")}); results point at ${first.file}, and code scanning will drop them`,
+        };
+    }
+    if (missed.length === 0)
+        return chosen;
+    return { ...chosen, warning: `SARIF: ${missed.map(describe).join(" and ")} is not in the repository; results point at ${chosen.file} instead` };
+}
+/** The repository root the paths are relative to: the Actions checkout when there is one, else the project. */
+export function repositoryRoot(env, projectDir) {
+    return env.GITHUB_WORKSPACE || projectDir;
+}
+/** `target` relative to `root` with forward slashes, or null when it is outside it. */
+export function repoRelative(root, target) {
+    const rel = path.relative(path.resolve(root), path.resolve(target));
+    if (rel === "")
+        return "";
+    if (rel.startsWith("..") || path.isAbsolute(rel))
+        return null;
+    return rel.split(path.sep).join("/");
+}
+/** The file a result points at: its flow's file when a flow raised it and the flows are in the repository, else the anchor. */
+export function sarifFileFor(files, flowFile) {
+    return flowFile && files.flowsDir !== undefined ? (files.flowsDir ? `${files.flowsDir}/${flowFile}` : flowFile) : files.anchor;
+}
+/**
+ * One SARIF location: a repository file code scanning can resolve, and the
+ * route as a logical location of kind "resource".
+ */
+export function sarifLocation(file, route, message) {
+    return {
+        physicalLocation: { artifactLocation: { uri: file } },
+        logicalLocations: [{ kind: "resource", name: route, fullyQualifiedName: route }],
+        ...(message ? { message: { text: message } } : {}),
+    };
+}
+/**
+ * Everything a run's SARIF needs to know about the repository, from its
+ * option, its environment and the directories it read. `exists` takes an
+ * absolute path.
+ */
+export function sarifFilesFor(o) {
+    const root = repositoryRoot(o.env, o.projectDir);
+    const { file, source, warning } = resolveSarifAnchor({ option: o.option, env: o.env, exists: (f) => o.exists(path.join(root, f)) });
+    const flowsDir = o.flowsDir ? repoRelative(root, o.flowsDir) : null;
+    return { anchor: file, source, ...(warning ? { warning } : {}), ...(flowsDir !== null ? { flowsDir } : {}) };
+}

package/dist/engine/settle.js

@@ -51,6 +51,73 @@ export function shouldKeepWaiting(state) {
     // NEXT action, which is then blamed for it.
     return Math.min(state.sinceLastStartMs, state.elapsedMs) < QUIET_MS;
 }
+/**
+ * Which requests are still in flight, for the wait above.
+ *
+ * Counting the context's request events up and down is not enough. A request
+ * that has had its response headers but not its whole body when its document
+ * goes away (the page is left, or a frame is removed or moves on) gets neither
+ * a "finished" nor a "failed" event, so a plain counter never comes back down
+ * and every later wait runs to its cap. Each request is therefore held with the
+ * frame that sent it and the order it started in, and is dropped when it ends,
+ * when its frame is gone, or when its frame commits a navigation that started
+ * after it did. A same-document navigation (history.pushState) sends no
+ * navigation request, so it drops nothing — unless a navigation that answered
+ * without a new document (a 204, a download) is still pending for that frame,
+ * in which case the requests started before it are dropped early. Generic over the request and frame
+ * types so it is tested without a browser.
+ */
+export class InFlightRequests {
+    open = new Map();
+    /** Per frame, the order of the latest navigation request it sent that has not yet committed. */
+    pendingNavigation = new Map();
+    order = 0;
+    /** A request started. `frame` is undefined for one no frame sent (a worker's). */
+    started(request, frame, isNavigation) {
+        const order = ++this.order;
+        this.open.set(request, { frame, order });
+        if (isNavigation && frame !== undefined)
+            this.pendingNavigation.set(frame, order);
+    }
+    /**
+     * A request finished or failed. One already dropped is ignored, so it cannot
+     * be counted out twice. A navigation that failed never commits, so it stops
+     * being the one a later commit of its frame is measured against. A finished
+     * one may still be about to commit (its body can end first), so it stays.
+     */
+    ended(request, failed = false) {
+        const held = this.open.get(request);
+        this.open.delete(request);
+        if (failed && held?.frame !== undefined && this.pendingNavigation.get(held.frame) === held.order)
+            this.pendingNavigation.delete(held.frame);
+    }
+    /**
+     * A frame committed a navigation. Requests its old document sent before the
+     * navigation began are dropped; the navigation itself and anything started
+     * after it stay. Without a navigation request (a same-document change) nothing is dropped.
+     */
+    navigated(frame) {
+        const navigation = this.pendingNavigation.get(frame);
+        if (navigation === undefined)
+            return;
+        this.pendingNavigation.delete(frame);
+        for (const [request, held] of this.open)
+            if (held.frame === frame && held.order < navigation)
+                this.open.delete(request);
+    }
+    /** Frames that are gone (detached, or their page closed): every request they sent is dropped. */
+    gone(isGone) {
+        for (const [request, held] of this.open)
+            if (held.frame !== undefined && isGone(held.frame))
+                this.open.delete(request);
+        for (const frame of [...this.pendingNavigation.keys()])
+            if (isGone(frame))
+                this.pendingNavigation.delete(frame);
+    }
+    get count() {
+        return this.open.size;
+    }
+}
 /** A pace a session asked for, clamped. Negative or absurd values are a typo, not an instruction. */
 export const PACE_MAX_MS = 60_000;
 export function normalizePace(paceMs) {