scenescout 3.19.1 → 3.19.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # scenescout
 
+## 3.19.2
+
+### Patch Changes
+
+- 3b953a7: `refused-empty` now pairs an empty-state sentence with the refused read it is about (#413). A sentence that names what is missing ("No comments yet", "There are no orders") is reported at high when a refused read's path names the same thing, and not at all when a successful data read on the page fetched that thing instead: it is a genuinely empty section beside an unrelated refusal. A named sentence that matches neither is still reported, at medium, so `scenescout check` no longer fails a `--fail-on high` gate on it. Sentences that name nothing in particular ("No results", "Nothing to show") and empty rendered lists pair with any refused read at high, as before, and the finding names the refused read the sentence points at. Existing `refused-empty` fingerprints can change once on upgrade, because the evidence may now name a different read.
+
 ## 3.19.1
 
 ### Patch Changes

package/dist/engine/browser.js

@@ -935,9 +935,13 @@ export class BrowserEngine {
             }
         }
         for (const found of findContradictions(requests, state, before, acted && actedNow ? { before: acted.before, after: actedNow } : null)) {
-            if (this.contradictionsReported.has(found.evidence))
+            // Once per refused request a session, except that a high reading of it
+            // replaces an earlier medium one (#413).
+            const severity = found.severity ?? "high";
+            const earlier = this.contradictionsReported.get(found.evidence);
+            if (earlier === "high" || earlier === severity)
                 continue;
-            this.contradictionsReported.add(found.evidence);
+            this.contradictionsReported.set(found.evidence, severity);
             this.oracles.noteContradiction(found, url);
         }
     }
@@ -974,7 +978,7 @@ export class BrowserEngine {
         }
     }
     /** Contradiction signatures already reported this session — the same refused endpoint on every page must not flood the run. */
-    contradictionsReported = new Set();
+    contradictionsReported = new Map();
     async scanForInjections() {
         const page = this.page;
         // One copy for the whole scan: the list is shared with every lane, and
@@ -1109,7 +1113,7 @@ export class BrowserEngine {
         this.blockNotices.reset();
         this.dialogsSeen = [];
         this.watchedResponses = [];
-        this.contradictionsReported = new Set();
+        this.contradictionsReported = new Map();
         this.tokenPostsReported = new Set();
         this.pendingCreations = new Set();
         this.baseUrl = opts.url.replace(/\/$/, "");

package/dist/engine/check.js

@@ -169,6 +169,14 @@ function stripRefs(line) {
 function withoutOrigin(text, origin) {
     return origin ? text.split(origin).join("") : text;
 }
+/**
+ * A violation's own severity where it is lower than its rule's: a refused read
+ * beside an empty state that may be about another section is medium (#413).
+ * Every other violation takes its rule's severity.
+ */
+function violationSeverity(v) {
+    return v.kind === "refused_empty" && v.severity === "medium" ? "medium" : undefined;
+}
 function violationRule(v) {
     switch (v.kind) {
         case "page_error":
@@ -309,7 +317,7 @@ export function checkFindings(routes, origin, ignore = [], flows = [], baselines
         else if (r.elements === 0 && (r.status === null || r.status < 400))
             add("dead-end", `${route}: 0 controls`, route);
         for (const v of r.violations)
-            add(violationRule(v), v.detail, route, { embed: v.embed });
+            add(violationRule(v), v.detail, route, { embed: v.embed, severity: violationSeverity(v) });
         for (const line of r.geometry) {
             const rule = geometryRule(line);
             if (rule)
@@ -327,7 +335,7 @@ export function checkFindings(routes, origin, ignore = [], flows = [], baselines
     }
     for (const f of flows) {
         for (const { path, violation } of f.violations)
-            add(violationRule(violation), violation.detail, path, { embed: violation.embed, flow: f.file });
+            add(violationRule(violation), violation.detail, path, { embed: violation.embed, flow: f.file, severity: violationSeverity(violation) });
         // A refused step is not the app's defect: the check reports it as "could not run" (refusedFlowReason).
         if (f.outcome.status === "failed")
             add("flow-step-failed", flowStepEvidence(f), f.outcome.path, { flow: f.file });

package/dist/engine/claims.js

@@ -145,6 +145,154 @@ export function classify(text) {
         return "empty";
     return null;
 }
+/**
+ * Words in an empty-state sentence that name nothing in particular: the
+ * generic nouns for "the things", the verbs that follow them ("No results
+ * found", "No entries recorded yet") and the adjectives in front of them ("No
+ * new items", "No matching records"). Stemmed, as `stem` leaves them.
+ */
+const GENERIC_EMPTY_WORDS = new Set([
+    "result",
+    "item",
+    "record",
+    "row",
+    "data",
+    "entry",
+    "match",
+    "thing",
+    "one",
+    "yet",
+    "found",
+    "show",
+    "display",
+    "here",
+    "recorded",
+    "added",
+    "created",
+    "saved",
+    "available",
+    "been",
+    "matching",
+    "more",
+    "new",
+    "recent",
+    "upcoming",
+    "open",
+    "pending",
+    "other",
+    "further",
+    "api",
+    "v1",
+    "v2",
+    "v3",
+]);
+/** Words that end the subject of an empty-state sentence: "No results | for your search". */
+const SUBJECT_STOP_WORDS = new Set([
+    "for",
+    "your",
+    "you",
+    "to",
+    "in",
+    "on",
+    "of",
+    "at",
+    "by",
+    "with",
+    "that",
+    "this",
+    "which",
+    "from",
+    "match",
+    "matches",
+    "yet",
+    "found",
+    "here",
+    "available",
+    "left",
+    "anymore",
+    "have",
+    "has",
+    "had",
+    "been",
+    "was",
+    "were",
+    "is",
+    "are",
+    "such",
+]);
+/** Crude singular form, enough to match "comments" to "/comment/" and "entries" to "/entry". */
+function stem(word) {
+    const w = word.toLowerCase();
+    if (w.endsWith("ies") && w.length > 4)
+        return `${w.slice(0, -3)}y`;
+    if (w.endsWith("yses"))
+        return `${w.slice(0, -4)}ysis`;
+    if (w.endsWith("uses"))
+        return w.slice(0, -2);
+    if (w.endsWith("es") && /(?:ss|x|ch|sh)es$/.test(w))
+        return w.slice(0, -2);
+    if (w.endsWith("s") && !/(?:ss|us|is)$/.test(w) && w.length > 3)
+        return w.slice(0, -1);
+    return w;
+}
+/** A word or a path segment as stems, split on hyphens and underscores the same way on both sides. */
+function stems(text) {
+    return text
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean)
+        .map(stem);
+}
+/**
+ * The words naming what an empty-state sentence says is missing: "comment"
+ * for "No comments yet", "corrective action" for "No corrective actions
+ * recorded yet", "order" for "There are no orders". Empty for sentences that
+ * name nothing in particular ("No results for your search", "Nothing to show",
+ * "This list is empty"). Read from where the empty-state phrase starts, so a
+ * "no" earlier in the text ("No longer available. No results.") is not taken.
+ */
+export function emptyStateSubject(text) {
+    const at = EMPTY_RE.exec(text)?.index ?? 0;
+    const m = /\bno\s+((?:[a-z][a-z-]*\s+){0,3}[a-z][a-z-]*)/i.exec(text.slice(at));
+    if (!m)
+        return [];
+    const words = [];
+    for (const word of m[1].split(/\s+/)) {
+        if (SUBJECT_STOP_WORDS.has(word.toLowerCase()))
+            break;
+        words.push(...stems(word));
+    }
+    return words.filter((w) => w.length > 2 && !GENERIC_EMPTY_WORDS.has(w));
+}
+/** Whether a request's path names one of these subject words. */
+function pathNames(req, subject) {
+    let path;
+    try {
+        path = new URL(req.url).pathname;
+    }
+    catch {
+        path = req.url;
+    }
+    const segments = new Set(stems(path));
+    return subject.some((w) => segments.has(w));
+}
+/**
+ * Pairs one empty-state sentence with the refused reads it could be about.
+ * `loaded` are the page's reads that succeeded: positive evidence that a
+ * sentence naming what they fetched is a genuinely empty section rather than
+ * a refusal hidden behind an empty state.
+ */
+export function pairEmptyState(text, refusedReads, loaded) {
+    const subject = emptyStateSubject(text);
+    if (subject.length === 0)
+        return { certain: true, read: refusedReads[0] };
+    const named = refusedReads.find((r) => pathNames(r, subject));
+    if (named)
+        return { certain: true, read: named };
+    if (loaded.some((r) => pathNames(r, subject)))
+        return { unrelated: true };
+    return { certain: false, read: refusedReads[0], subject };
+}
 /** What counts as an open dialog: a native one or an ARIA one. */
 const DIALOG_SEL = 'dialog[open], [role="dialog"], [role="alertdialog"]';
 /** Page-side count of the open dialogs alone, for a caller that needs nothing else the claim scan reads. */
@@ -211,17 +359,40 @@ export function findContradictions(requests, page, before, acted) {
         return [];
     const out = [];
     const reads = refused.filter((r) => !WRITING_METHODS.has(r.method.toUpperCase()));
-    const saysEmpty = claims.includes("empty") || page.emptyLists > 0;
-    if (reads.length > 0 && saysEmpty) {
-        const worst = reads[0];
-        const how = claims.includes("empty") ? "an empty state" : `an empty list (${page.emptyLists})`;
-        out.push({
-            kind: "refused_empty",
-            detail: `${say(worst)} was refused, and the page shows ${how} with no error. ` +
-                `The user is told there is nothing to see when the truth is that nothing could be loaded.` +
-                standIn(worst),
-            evidence: `refused-empty ${say(worst)}`,
-        });
+    if (reads.length > 0) {
+        // An empty-state sentence that names what is missing is evidence about
+        // requests for that thing (#413). "No comments yet" beside a refused
+        // history read, with the comments read loaded fine, is a genuinely empty
+        // comments section, not a refusal shown as an empty state.
+        // Positive evidence only: a data read the page made that succeeded. The
+        // page's own document, its images and scripts, and redirects say nothing
+        // about which section of it is empty.
+        const loaded = requests.filter((r) => (r.resourceType === "xhr" || r.resourceType === "fetch") &&
+            r.status !== null &&
+            r.status >= 200 &&
+            r.status < 300 &&
+            !WRITING_METHODS.has(r.method.toUpperCase()));
+        const pairings = page.texts.filter((_, i) => claims[i] === "empty").map((t) => ({ text: t, pairing: pairEmptyState(t, reads, loaded) }));
+        // A sentence naming what a refused read fetched points at that read; a generic one points at none in particular.
+        const certain = pairings.find((p) => "certain" in p.pairing && p.pairing.certain && emptyStateSubject(p.text).length > 0) ??
+            pairings.find((p) => "certain" in p.pairing && p.pairing.certain);
+        const possible = pairings.find((p) => "certain" in p.pairing && !p.pairing.certain);
+        const hit = certain ?? (page.emptyLists > 0 ? undefined : possible);
+        if (hit || page.emptyLists > 0) {
+            const read = hit && "read" in hit.pairing ? hit.pairing.read : reads[0];
+            const how = hit ? "an empty state" : `an empty list (${page.emptyLists})`;
+            const unsure = hit !== undefined && hit === possible;
+            out.push({
+                kind: "refused_empty",
+                detail: `${say(read)} was refused, and the page shows ${how} with no error. ` +
+                    (unsure
+                        ? `The empty state ("${hit.text}") names something no request on the page was for, so it may be about another section; the user may be told there is nothing to see when nothing could be loaded.`
+                        : `The user is told there is nothing to see when the truth is that nothing could be loaded.`) +
+                    standIn(read),
+                evidence: `refused-empty ${say(read)}`,
+                ...(unsure ? { severity: "medium" } : {}),
+            });
+        }
     }
     // Only writes this action sent, and not the page's own infrastructure.
     const isActionWrite = (r) => WRITING_METHODS.has(r.method.toUpperCase()) && !r.background && !INFRASTRUCTURE_WRITE_RE.test(r.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.19.1",
+  "version": "3.19.2",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",