scenescout 3.17.0 → 3.18.0

package/dist/engine/probes.js

@@ -1,5 +1,6 @@
 import { ACCESSIBLE_NAME_SRC, DIALOG_LIKE_SEL } from "./collector.js";
 import { focusAdvanceKey, isBrowserEngine } from "../browsers.js";
+import { focusedControl } from "./design.js";
 /**
  * Scroll ONE named region rather than the page. The page-level heuristic
  * picks the largest scrollable pane, so a smaller independently-scrolling
@@ -158,6 +159,12 @@ export async function probeOverlays(page) {
         const s = getComputedStyle(el);
         return r.width > 0 && r.height > 0 && s.visibility !== "hidden" && s.display !== "none";
       };
+      // A translucent background or a blur: what dims the page behind a modal.
+      const darkens = (s) => {
+        const m = (s.backgroundColor || "").match(/rgba?\\((\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)(?:\\s*,\\s*([0-9.]+))?/);
+        const alpha = m ? (m[4] === undefined ? 1 : Number(m[4])) : 0;
+        return (alpha > 0.05 && alpha < 0.98) || ((s.backdropFilter || "") + "").includes("blur");
+      };
       // Backdrops: fixed, near-full-viewport, visually darkening/blurring.
       const backdrops = [];
       for (const el of document.querySelectorAll("body *")) {
@@ -166,10 +173,7 @@ export async function probeOverlays(page) {
         if (s.position !== "fixed") continue;
         const r = el.getBoundingClientRect();
         if (r.width < vw * 0.9 || r.height < vh * 0.9) continue;
-        const m = (s.backgroundColor || "").match(/rgba?\\((\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)(?:\\s*,\\s*([0-9.]+))?/);
-        const alpha = m ? (m[4] === undefined ? 1 : Number(m[4])) : 0;
-        const darkens = (alpha > 0.05 && alpha < 0.98) || ((s.backdropFilter || "") + "").includes("blur");
-        if (darkens) backdrops.push(el);
+        if (darkens(s)) backdrops.push(el);
       }
       const hasContent = (el) => {
         const t = (el.textContent || "").trim();
@@ -183,12 +187,47 @@ export async function probeOverlays(page) {
       const dialogsAll = [...document.querySelectorAll('${DIALOG_LIKE_SEL}')].filter((d) => visible(d));
       // Leaked modal scroll-lock: content extends past the fold, the page
       // itself cannot scroll (overflow hidden on body/html), and NO overlay
-      // of any kind — dialog-like panel OR backdrop — is up to justify the
+      // of any kind — dialog-like panel, backdrop or framed modal — is up to justify the
       // lock; everything below the fold is unreachable and the page looks
       // perfectly healthy otherwise.
+      // A modal can also live inside a frame: the top document then holds only
+      // a pinned wrapper around a full-viewport iframe, and the dialog and its
+      // backdrop are in the frame's document, out of reach of the selectors
+      // above. Such an iframe justifies the lock when it is visible, covers the
+      // viewport, is pinned (itself or through a fixed ancestor) and is not
+      // faded out or click-through, and, when its document can be read (same
+      // origin), something in it is open: a dialog-like panel or a dimming
+      // backdrop. A frame left mounted after its modal closed holds neither.
+      // Another site's frame cannot be read, so its geometry has to do.
+      const frameOverlay = (f) => {
+        if (!visible(f)) return false;
+        const r = f.getBoundingClientRect();
+        if (r.width < vw * 0.9 || r.height < vh * 0.9) return false;
+        let pinned = false;
+        for (let e = f; e && e !== document.body; e = e.parentElement) {
+          const s = getComputedStyle(e);
+          if (Number(s.opacity) === 0 || s.pointerEvents === "none") return false;
+          if (s.position === "fixed") pinned = true;
+        }
+        if (!pinned) return false;
+        // contentDocument is null for another site's frame.
+        const doc = f.contentDocument;
+        const win = doc && doc.defaultView;
+        if (!win) return true;
+        const fw = win.innerWidth, fh = win.innerHeight;
+        const shown = (el) => { const b = el.getBoundingClientRect(); const s = win.getComputedStyle(el); return b.width > 0 && b.height > 0 && s.visibility !== "hidden" && s.display !== "none"; };
+        if ([...doc.querySelectorAll('${DIALOG_LIKE_SEL}')].some(shown)) return true;
+        return [...doc.querySelectorAll("body *")].some((el) => {
+          const s = win.getComputedStyle(el);
+          if (s.position !== "fixed" || !shown(el)) return false;
+          const b = el.getBoundingClientRect();
+          return b.width >= fw * 0.9 && b.height >= fh * 0.9 && darkens(s);
+        });
+      };
+      const framedOverlay = [...document.querySelectorAll("iframe")].some(frameOverlay);
       const docH = Math.max(document.documentElement.scrollHeight, document.body ? document.body.scrollHeight : 0);
       const ovLock = [getComputedStyle(document.documentElement).overflowY, document.body ? getComputedStyle(document.body).overflowY : ""].some((o) => o === "hidden" || o === "clip");
-      if (ovLock && docH > vh + 50 && dialogsAll.length === 0 && backdrops.length === 0) {
+      if (ovLock && docH > vh + 50 && dialogsAll.length === 0 && backdrops.length === 0 && !framedOverlay) {
         issues.push("OVERLAY: page scrolling is DISABLED (overflow hidden on body/html) with " + Math.round(docH - vh) + "px of content below the fold and NO open dialog to justify it — likely a leaked modal scroll-lock; users cannot reach the rest of the page");
       }
       if (backdrops.length === 0) return issues;
@@ -249,8 +288,11 @@ export async function probeOverlays(page) {
  * focusless. As Tab advances, the previous stop is naturally blurred, so
  * each stop's focused style (captured at visit time) can be diffed against
  * its blurred style (captured in one pass at the end) without fighting the
- * tab order. Best-effort: any failure returns an empty sample set rather
- * than failing the audit.
+ * tab order. A Tab onto a frame is followed into a same-origin frame's
+ * document and the control focused there is sampled; a press that leaves
+ * focus inside a frame it cannot read is skipped (design.ts focusedControl).
+ * Best-effort: any failure returns an empty sample set rather than failing
+ * the audit.
  */
 export async function probeFocusIndicators(page) {
     const name = page.context().browser()?.browserType().name();
@@ -261,11 +303,11 @@ export async function probeFocusIndicators(page) {
         for (let i = 0; i < 15; i++) {
             await page.keyboard.press(advanceKey);
             const info = (await page.evaluate(`(() => {
-        const el = document.activeElement;
-        if (!el || el === document.body || el === document.documentElement) return null;
+        const el = (${focusedControl.toString()})(document);
+        if (el === null || el === "frame") return el;
         if (el.hasAttribute("data-scout-focus-probe")) return "wrapped";
         el.setAttribute("data-scout-focus-probe", "${i}");
-        const s = getComputedStyle(el);
+        const s = el.ownerDocument.defaultView.getComputedStyle(el);
         const tid = el.getAttribute("data-testid");
         // Named as the snapshot names it, so an icon button reads by its aria-label here too.
         const name = (${ACCESSIBLE_NAME_SRC})(el).slice(0, 30);
@@ -273,15 +315,32 @@ export async function probeFocusIndicators(page) {
       })()`));
             if (info === null || info === "wrapped")
                 break;
+            if (info === "frame")
+                continue;
             stops.push({ i, ...info });
         }
-        await page.evaluate("document.activeElement && document.activeElement.blur && document.activeElement.blur()");
+        // Blur from the innermost focused element out, so a control focused inside a frame loses focus too.
+        await page.evaluate(`(() => {
+      const chain = [];
+      for (let d = document; d; ) {
+        const a = d.activeElement;
+        if (!a || a === d.body || a === d.documentElement) break;
+        chain.push(a);
+        d = /^i?frame$/i.test(a.tagName) ? a.contentDocument : null;
+      }
+      for (const a of chain.reverse()) if (a.blur) a.blur();
+    })()`);
+        // The marked stops live in the page and in every same-origin frame the walk followed focus into.
         const blurred = (await page.evaluate(`(() => {
       const out = {};
-      for (const el of document.querySelectorAll("[data-scout-focus-probe]")) {
-        const s = getComputedStyle(el);
-        out[el.getAttribute("data-scout-focus-probe")] = ${styleSig};
-        el.removeAttribute("data-scout-focus-probe");
+      const docs = [document];
+      for (let k = 0; k < docs.length; k++) {
+        for (const f of docs[k].querySelectorAll("iframe, frame")) if (f.contentDocument) docs.push(f.contentDocument);
+        for (const el of docs[k].querySelectorAll("[data-scout-focus-probe]")) {
+          const s = el.ownerDocument.defaultView.getComputedStyle(el);
+          out[el.getAttribute("data-scout-focus-probe")] = ${styleSig};
+          el.removeAttribute("data-scout-focus-probe");
+        }
       }
       return out;
     })()`));

package/dist/first-run.js

@@ -24,7 +24,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { APPROX_DISK_MB, launchTarget } from "./browsers.js";
 import { hasScheme, hostOf } from "./commands.js";
-import { CHECK_OPTION_NAMES, CHECK_RULES, countBySeverity, issueLine, issueSections, MAX_CHECK_ROUTES, MAX_DISCOVERY_ROUNDS, resolveArgPath, routesTable, SEVERITY_RANK, SHARED_CHROME_ROUTE, unauditedRoutes, unvisitedLine, worthALookSection, } from "./engine/check.js";
+import { CHECK_OPTION_NAMES, CHECK_RULES, countBySeverity, issueLine, issueSections, MAX_CHECK_ROUTES, MAX_DISCOVERY_ROUNDS, needsSignInText, resolveArgPath, resourcesTable, routesTable, SEVERITY_RANK, SHARED_CHROME_ROUTE, unauditedRoutes, unvisitedLine, worthALookSection, } from "./engine/check.js";
 import { httpStatusOf } from "./engine/oracles.js";
 /** Every `--option` a first look accepts. Anything more is `scenescout check`'s. */
 export const FIRST_RUN_OPTION_NAMES = ["max-routes", "max-minutes", "mode", "out"];
@@ -510,6 +510,11 @@ function notes({ result, options }, code) {
             out.push(`The start page moved to ${to}, so its links count as another site's and were not followed. To look further, run it there: ${code(`npx -y scenescout ${shellArg(`${to}/`)}`)}.`);
         }
     }
+    // A first look never has a session, so a page behind sign-in is a page it could not cover, not an issue.
+    const walled = result.needsSignIn?.length ?? 0;
+    if (walled > 0 && !start?.loginRedirect) {
+        out.push(needsSignInText(walled, `${code(`npx -y scenescout login ${shellArg(result.url)} --role <name>`)} saves a sign-in, and an agent run then attaches as that role`, "page"));
+    }
     const left = result.unvisited.length;
     switch (stopReason(result, options.maxRoutes)) {
         case "time":
@@ -575,6 +580,7 @@ export function formatFirstRun(facts) {
     lines.push(...issueSections(result.issues));
     lines.push(...worthALookSection(result.worthALook, false));
     lines.push(...routesTable(result));
+    lines.push(...resourcesTable(result.resources));
     const why = stopReason(result, facts.options.maxRoutes);
     lines.push(...unvisitedLine(result.unvisited, why ? UNVISITED_WHY[why] : "not reached"));
     lines.push("", "## What to try next", "", `- **Explore it with your coding agent.** ${code("npx -y scenescout install")} sets up the skill and the MCP server; then ask your agent to use SceneScout to test ${result.url}. It clicks, fills forms and compares roles, files what it finds and reports what it did not test.`, `- **Gate pull requests.** ${code(`npx -y scenescout check ${shellArg(result.url)}`)} is this look as a pass or a fail, with SARIF for code scanning; it also runs as a GitHub Action.`, `- **Pages behind a sign-in.** ${code(`npx -y scenescout login ${shellArg(result.url)} --role <name>`)} saves a sign-in once, and an agent run then attaches as that role.`, "", `The guide: ${GUIDE_URL}`, "", `_A first look opens pages and measures what loads, and fills and submits no form. ${modeSentence(result.mode)} (${SAFETY_URL}) It does not click through flows or compare roles; an exploratory run does that._`);

package/dist/intake.js

@@ -102,3 +102,164 @@ export function settingsFromAnswers(a) {
 export function introQuestions() {
     return INTAKE_QUESTIONS.map((q, i) => `${i + 1}. ${q.ask}`).join("\n");
 }
+// ── The questions as one form ────────────────────────────────────────────────
+//
+// A client that can show a form (MCP elicitation, form mode) gets the four
+// questions as one, through scout_intake; every other client, and a person who
+// declines or dismisses the form, gets them as text for the agent to ask in
+// chat. Specification: https://modelcontextprotocol.io/specification/2025-11-25/client/elicitation
+// (the version the SDK speaks; the 2026-07-28 revision keeps the same capability,
+// schema subset and three actions). Two of its rules shape this:
+// - a server MUST NOT send a mode the client did not declare, and an empty
+//   `elicitation` capability means form mode only (formElicitationSupported);
+// - a server MUST NOT ask for passwords, API keys or tokens in form mode. The
+//   form asks HOW the person signs in, never with what: the sign-in itself is
+//   scout_login's window.
+/** The tool that asks the questions, as a form where the client can show one. */
+export const INTAKE_TOOL = "scout_intake";
+/**
+ * Whether the client can show a form. Declared `form` says so; an empty
+ * `elicitation` object is form mode by the specification's backwards-compatibility
+ * rule; `url` alone, or no `elicitation` at all, is not.
+ */
+export function formElicitationSupported(capabilities) {
+    const e = capabilities?.elicitation;
+    if (!e || typeof e !== "object")
+        return false;
+    return e.form !== undefined || e.url === undefined;
+}
+const choice = (value, title) => ({ const: value, title });
+const askOf = (id) => INTAKE_QUESTIONS.find((q) => q.id === id).ask;
+/** Every value the form offers for a choice, with the words the person sees. */
+export const FORM_CHOICES = {
+    signIn: [
+        choice("none", "No sign-in"),
+        choice("sso", "Google or Microsoft single sign-on"),
+        choice("password", "An email and password"),
+        choice("one-time-code", "A one-time code"),
+    ],
+    whatToCheck: [
+        choice("everything", "Everything: the whole site"),
+        choice("description", "What I describe below"),
+        choice("tickets", "The tickets I paste below"),
+    ],
+    realData: [choice("yes", "Yes"), choice("no", "No"), choice("unsure", "Not sure")],
+};
+/** What the form says above its fields. */
+export const INTAKE_FORM_MESSAGE = "Four questions before SceneScout starts testing. It never asks for a password here: if the site needs one, a browser window opens later for you to sign in as you normally would.";
+/**
+ * The form, as an `elicitation/create` request's `requestedSchema`: a flat object
+ * of strings and single-choice lists, the only shapes form mode allows. `address`
+ * starts filled in when the agent already knows it. Real data starts at "Not sure",
+ * which tests as carefully as "Yes".
+ */
+export function intakeFormSchema(knownAddress) {
+    const address = knownAddress?.trim();
+    return {
+        type: "object",
+        properties: {
+            address: { type: "string", title: "Address", description: askOf("address"), minLength: 1, ...(address ? { default: address } : {}) },
+            signIn: { type: "string", title: "Sign-in", description: askOf("sign-in"), oneOf: [...FORM_CHOICES.signIn] },
+            whatToCheck: {
+                type: "string",
+                title: "What to check",
+                description: "What should I check?",
+                oneOf: [...FORM_CHOICES.whatToCheck],
+                default: "everything",
+            },
+            details: {
+                type: "string",
+                title: "Description or tickets",
+                description: "Describe what to check in a sentence, or paste the tickets with a line of --- between them. To upload a file of tickets instead, leave this empty and I will ask for it.",
+            },
+            realData: { type: "string", title: "Real data", description: askOf("real-data"), oneOf: [...FORM_CHOICES.realData], default: "unsure" },
+        },
+        required: ["address", "signIn", "whatToCheck", "realData"],
+    };
+}
+const oneOf = (list, value) => list.find((c) => c.const === value)?.const;
+/** Pasted tickets, split on a line of three or more dashes, empty ones dropped. */
+export function splitTickets(text) {
+    return text
+        .split(/^[ \t]*-{3,}[ \t]*$/m)
+        .map((t) => t.trim())
+        .filter(Boolean);
+}
+const SIGN_IN_WORDS = {
+    none: "no sign-in",
+    sso: "Google or Microsoft single sign-on",
+    password: "an email and password",
+    "one-time-code": "a one-time code",
+};
+/**
+ * What a form round comes to. Accepted answers become settings through
+ * settingsFromAnswers. Anything else asks in chat: all four questions when
+ * there was no form or the person turned it down, and only what is still
+ * missing when the form came back without it (tickets to upload, an empty
+ * description). An answer is never guessed.
+ */
+export function intakeFromForm(outcome) {
+    const all = (why) => ({ kind: "ask", questions: [...INTAKE_QUESTIONS], known: [], why });
+    if (outcome.kind === "unsupported")
+        return all("this client cannot show a form");
+    if (outcome.kind === "declined")
+        return all("the person declined the form");
+    if (outcome.kind === "cancelled")
+        return all("the person closed the form without answering");
+    if (outcome.kind === "failed")
+        return all(`the form failed: ${outcome.error}`);
+    const c = outcome.content;
+    const address = typeof c.address === "string" ? c.address.trim() : "";
+    const signIn = oneOf(FORM_CHOICES.signIn, c.signIn);
+    const kind = oneOf(FORM_CHOICES.whatToCheck, c.whatToCheck);
+    const realData = oneOf(FORM_CHOICES.realData, c.realData);
+    const details = typeof c.details === "string" ? c.details.trim() : "";
+    let whatToCheck;
+    // "Everything" with text in the box is a contradiction (the choice starts on everything, so pasted tickets
+    // would be dropped unseen): asked again rather than guessed either way.
+    if (kind === "everything" && !details)
+        whatToCheck = "everything";
+    else if (kind === "description" && details)
+        whatToCheck = { description: details };
+    else if (kind === "tickets" && splitTickets(details).length > 0)
+        whatToCheck = { tickets: splitTickets(details) };
+    const missing = INTAKE_QUESTIONS.filter((q) => (q.id === "address" && !address) || (q.id === "sign-in" && !signIn) || (q.id === "what-to-check" && !whatToCheck) || (q.id === "real-data" && !realData));
+    if (!address || !signIn || !whatToCheck || !realData) {
+        const known = [
+            address ? `Address: ${address}` : "",
+            signIn ? `Sign-in: ${SIGN_IN_WORDS[signIn]}` : "",
+            kind === "everything" && details
+                ? "What to check: everything was chosen, but there is text in the box too"
+                : kind
+                    ? `What to check: ${kind}${whatToCheck ? "" : ", not given yet"}`
+                    : "",
+            realData ? `Real data: ${FORM_CHOICES.realData.find((r) => r.const === realData).title.toLowerCase()}` : "",
+        ].filter(Boolean);
+        return { kind: "ask", questions: missing, known, why: "the form came back without every answer" };
+    }
+    return { kind: "settings", settings: settingsFromAnswers({ address, signIn, whatToCheck, realData }) };
+}
+/** scout_intake's reply as text: the calls to make in order, or the questions to ask in chat. */
+export function intakeReplyText(reply) {
+    if (reply.kind === "ask") {
+        const numbered = reply.questions.map((q, i) => `${i + 1}. ${q.ask}`).join("\n");
+        return [
+            `No settings from a form (${reply.why}). Ask the person ${reply.questions.length === 1 ? "this question" : "these questions"} in chat, in one message, then choose the settings from the answers as the method says.`,
+            ...(reply.known.length > 0 ? ["", "Already answered in the form:", ...reply.known.map((k) => `- ${k}`)] : []),
+            "",
+            numbered,
+        ].join("\n");
+    }
+    const s = reply.settings;
+    const steps = [];
+    if (s.login) {
+        steps.push(`Tell the person: "${s.login.tellUser}"`);
+        steps.push(`Call ${s.login.tool} ${JSON.stringify({ url: s.login.url, role: s.login.role })}, which returns once they are signed in.`);
+    }
+    steps.push(`Call scout_attach ${JSON.stringify(s.attach)}, with projectPath as the method's setup says.`);
+    if (s.readTickets)
+        steps.push(`Once attached, read the tickets: ${s.readTickets.tool} ${JSON.stringify({ text: s.readTickets.text })}.`);
+    if (s.focus)
+        steps.push(`Keep to this area: ${s.focus}`);
+    return ["The person answered the form. Use these settings; do not ask the questions again.", ...steps.map((step, i) => `${i + 1}. ${step}`)].join("\n");
+}

package/dist/mcp-server.js

@@ -71,6 +71,7 @@ import { chooseProjectFolder, PROJECTS_DIR_ENV, workspaceFromRoots } from "./eng
 import { RECORD_MAX_FRAMES, resolveFrame } from "./engine/replay.js";
 import { describePace, normalizePace } from "./engine/settle.js";
 import { needsTask, taskRefusal, TASK_MAX } from "./engine/task.js";
+import { formElicitationSupported, INTAKE_FORM_MESSAGE, INTAKE_TOOL, intakeFormSchema, intakeFromForm, intakeReplyText } from "./intake.js";
 import { EXPLORE_PROMPT_ARGUMENTS, explorePrompt, loadPlaybook, PLAYBOOK_PROMPT, PLAYBOOK_TOOL, SERVER_INSTRUCTIONS } from "./playbook.js";
 import { livePrompt, loginPrompt, LOGIN_PROMPT, LIVE_PROMPT, LOGIN_PROMPT_ARGUMENTS, LIVE_PROMPT_ARGUMENTS } from "./prompts.js";
 import { formatScan, scanProject } from "./scan.js";
@@ -543,6 +544,46 @@ server.registerTool(PLAYBOOK_TOOL, {
         return errorText(err);
     }
 });
+// The start-of-run questions as one form, where the client can show one (MCP
+// elicitation, form mode); otherwise, or when the person declines or closes it,
+// the questions come back as text for the agent to ask in chat. The mapping is
+// intake.ts's; this only shows the form and reports how it ended.
+/** How long the form waits for the person before the questions go back to chat. */
+const INTAKE_FORM_WAIT_MS = 10 * 60_000;
+server.registerTool(INTAKE_TOOL, {
+    description: "Ask the start-of-run questions (the site's address, whether and how to sign in, what to check, whether the site holds real data) when the person gave no settings. " +
+        "Where this client can show a form, the person answers there and this returns the settings to use: the scout_login and scout_attach calls, in order. " +
+        "Otherwise, or when they decline or close the form, it returns the questions for you to ask in chat. Never asks for a password. Touches no browser.",
+    inputSchema: {
+        url: z.string().max(2048).optional().describe("The site's address, when the person already said it: the form starts with it filled in"),
+    },
+}, async ({ url }, extra) => {
+    let outcome;
+    if (!formElicitationSupported(server.server.getClientCapabilities()))
+        outcome = { kind: "unsupported" };
+    else {
+        try {
+            const result = await server.server.elicitInput({ mode: "form", message: INTAKE_FORM_MESSAGE, requestedSchema: intakeFormSchema(url) }, { timeout: INTAKE_FORM_WAIT_MS, signal: extra.signal, relatedRequestId: extra.requestId });
+            outcome =
+                result.action === "accept"
+                    ? { kind: "accepted", content: result.content ?? {} }
+                    : result.action === "decline"
+                        ? { kind: "declined" }
+                        : { kind: "cancelled" };
+        }
+        catch (err) {
+            // A client that advertised forms and then failed one: the questions still get asked, in chat, with why.
+            outcome = { kind: "failed", error: err instanceof Error ? err.message : String(err) };
+            console.error(`[scenescout] ${INTAKE_TOOL}: the form failed, asking in chat instead: ${outcome.error}`);
+        }
+    }
+    try {
+        return { content: [{ type: "text", text: intakeReplyText(intakeFromForm(outcome)) }] };
+    }
+    catch (err) {
+        return errorText(err);
+    }
+});
 // Prompts, for clients that list server prompts as commands. Registered on the
 // protocol server directly: the SDK's prompt helper rejects a request that
 // carries no `arguments` object, which is exactly what a client sends when the

package/dist/playbook.js

@@ -77,7 +77,7 @@ export function explorePrompt(playbook, args) {
     }
     // Nothing asked for at all: the person has chosen no settings, so the run starts with the plain questions.
     if (given("url") === undefined && level === undefined && given("focus") === undefined) {
-        return `${playbook}\n\n---\n\nRun an exploratory test session following the method above. I gave no settings: before setup, ask me these questions in one message, then choose the settings from my answers as the method says.\n${introQuestions()}`;
+        return `${playbook}\n\n---\n\nRun an exploratory test session following the method above. I gave no settings: before setup, call scout_intake, which asks me these questions in a form where this client can show one; when it returns them as text instead, ask me them in one message, then choose the settings from my answers as the method says.\n${introQuestions()}`;
     }
     const asks = [
         given("url") ? `Target: ${given("url")}` : "Target: ask me for the URL of the running app, or find it from the project.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.17.0",
+  "version": "3.18.0",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",

package/skills/scenescout/SKILL.md

@@ -11,7 +11,7 @@ You are the brain of an exploratory UI tester. The SceneScout MCP server gives y
 
 ## Starting a run: plain questions, or flags
 
-**No flags given** (none of `--url`, `--role`, `--focus`, `--level`, `--observe`, `--read-only`, `--safe-write`, `--allow-destructive`): before setup, ask these four questions in one message, in plain words, and choose the settings from the answers. Skip a question only when the person's request already answers it in words ("test http://localhost:3000" answers the first).
+**No flags given** (none of `--url`, `--role`, `--focus`, `--level`, `--observe`, `--read-only`, `--safe-write`, `--allow-destructive`): before setup, call `scout_intake` (with `url` when the person's request already names the address, so the form starts with it). Where the client can show a form, the person answers the four questions there and it returns the settings: make the calls it lists, in order, and ask nothing more. Where it cannot, or the person declines or closes the form, it returns the questions instead: ask them in one message, in plain words, and choose the settings from the answers by the table below. Skip a question only when the person's request already answers it in words ("test http://localhost:3000" answers the first). With no `scout_intake` tool, ask them yourself.
 
 1. What is the address of the site?
 2. Do you need to sign in to use it? If so, how: Google or Microsoft single sign-on, an email and password, or a one-time code?