scenescout 3.21.1 → 3.21.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # scenescout
 
+## 3.21.3
+
+### Patch Changes
+
+- 4c50ea3: `scenescout login --script` no longer reports a correct password or one-time code as refused when the app is slow to leave the page. A submitted field counts as refused only once the page has answered (emptied the field, drawn it again or moved on); while the very field it was typed into still holds it, disabled or not, the run keeps waiting, and at the timeout says the sign-in did not finish in time instead of calling it refused. An app that leaves a wrong password or code in its field, showing an error, used to be reported as refused at once; it is now reported when the timeout runs out, with the page's error quoted.
+
+## 3.21.2
+
+### Patch Changes
+
+- 8e70289: `/scenescout qa check`: when GitHub refuses a dispatch for a reason the reply does not name, the job's log now carries GitHub's own words, with anything shaped like a token redacted, as the reply says it does. Reading the artifact's zip refuses a central directory over 4 MB before reading it. The guide's safety model now covers the check mode: the commenter starts the project's workflow, with its secrets, on a branch in the same repository, and the verdict is only as trustworthy as that branch.
+
 ## 3.21.1
 
 ### Patch Changes

package/dist/engine/scripted-login.js

@@ -563,6 +563,29 @@ export function afterTyping(typed, page, shownBefore, opts = {}) {
 export function fieldIdentity(f) {
     return [f.tag, f.type, f.name, f.id, f.autocomplete, f.label].join("|");
 }
+/** The very element a value was typed into, still holding it: a submit the page has not answered yet. */
+const unanswered = (f) => f !== undefined && f.typed === true && f.filled;
+/**
+ * The submitted code or password whose very element is still on the page
+ * holding what was typed, disabled or not: the page has not answered that
+ * submit yet. A disabled field is not chosen for a step, so without this a
+ * page that disables the code field while it checks the code reads as having
+ * no sign-in field left, which is not a sign-in.
+ */
+export function unansweredSubmit(fields, submitted) {
+    const all = chooseFields(fields.map((f) => ({ ...f, disabled: false })));
+    return ["otp", "password"].find((k) => submitted.has(k) && unanswered(all[k]));
+}
+/** Waiting on a submit the page has not answered, or, past the deadline, the timeout that says so. */
+function awaitAnswer(pending, opts) {
+    if (opts.timedOutAfterS === undefined)
+        return { kind: "wait" };
+    const what = pending === "otp" ? "the one-time code" : "the password";
+    return {
+        kind: "timeout",
+        reason: `the sign-in did not finish within ${opts.timedOutAfterS}s: ${what} was submitted and the page still shows it in the same field`,
+    };
+}
 /**
  * Decide the next step from what is on the page now.
  *
@@ -575,6 +598,16 @@ export function fieldIdentity(f) {
  * - Refused: a field already submitted is back — the password field after the
  *   password went, the code field after the code went, or the same username
  *   field, empty, after the password went: the provider sent the form back.
+ *   The very element the password or code was typed into, still holding it,
+ *   is not back: the page has not answered the submit yet (a slow check, or a
+ *   redirect that has not started), so the run waits. Back means the page
+ *   answered: it emptied that field, or drew it again (a new element, or
+ *   another page).
+ * - Waiting, too, while that element is on the page disabled (checking): the
+ *   page is checking the value, so no field showing is not yet a sign-in.
+ * - Timed out: the deadline passed (timedOutAfterS) with that element still
+ *   holding what was typed. Nothing says the value was refused, so the reason
+ *   says the sign-in did not finish in time.
  * - A password field with no password configured, or a code field with no
  *   code or TOTP secret configured, is stuck, with the variable to set.
  * - Otherwise fill what is showing and has not been submitted, or wait.
@@ -586,18 +619,21 @@ export function nextStep(onPage, progress, opts) {
     const { submitted } = progress;
     const chosen = signInFields(onPage, submitted, opts);
     const sameUsername = chosen.username !== undefined && submitted.get("username") === fieldIdentity(chosen.username);
-    if (submitted.has("password") && chosen.password) {
+    if (submitted.has("password") && chosen.password && !unanswered(chosen.password)) {
         return { kind: "refused", reason: "the password field came back after the password was submitted: the username or password was refused" };
     }
     if (submitted.has("password") && sameUsername && !chosen.username.filled) {
         return { kind: "refused", reason: "the sign-in form came back after the password was submitted: the username or password was refused" };
     }
-    if (submitted.has("otp") && chosen.otp) {
+    if (submitted.has("otp") && chosen.otp && !unanswered(chosen.otp)) {
         const check = opts.code === "fixed" ? `check ${LOGIN_ENV.otpCode} is the code the app accepts` : "check the TOTP secret and the runner's clock";
         return { kind: "refused", reason: `the one-time-code field came back after a code was submitted: the code was refused (${check})` };
     }
+    const pending = ["otp", "password"].find((k) => submitted.has(k) && unanswered(chosen[k])) ?? opts.checking;
     const usernameIsSignIn = chosen.username !== undefined && (!submitted.has("username") || sameUsername);
     if (!chosen.password && !chosen.otp && !usernameIsSignIn) {
+        if (pending)
+            return awaitAnswer(pending, opts);
         const credentialSent = submitted.has("password") || submitted.has("otp");
         if (progress.submits === 0 || opts.successConfigured || !credentialSent)
             return { kind: "wait" };
@@ -610,7 +646,9 @@ export function nextStep(onPage, progress, opts) {
         return { kind: "stuck", reason: `the page asks for a one-time code and neither ${LOGIN_ENV.otpCode} nor ${LOGIN_ENV.totpSecret} is set` };
     }
     const fill = ["username", "password", "otp"].filter((k) => chosen[k] && !submitted.has(k));
-    return fill.length > 0 ? { kind: "fill", fill } : { kind: "wait" };
+    if (fill.length > 0)
+        return { kind: "fill", fill };
+    return pending ? awaitAnswer(pending, opts) : { kind: "wait" };
 }
 /**
  * The chosen fields that belong to the sign-in. A code field known only by

package/dist/login-run.js

@@ -22,7 +22,7 @@ import { explicitLimits, isTimeoutMessage, LIMIT_NAMES } from "./engine/limits.j
 import { redactRoute } from "./engine/check.js";
 import { describeLifetime, readLifetime } from "./engine/expiry.js";
 import { describeSaved, mergeSessionStorage, withSessionStorage, writeProfile } from "./engine/profiles.js";
-import { afterTyping, chooseFields, describeStep, fieldIdentity, filledNames, nextStep, otpBoxes, quotable, secondsLeft, splitCode, totp as totpCode, TOTP_MIN_SECONDS_LEFT, urlMatches, } from "./engine/scripted-login.js";
+import { afterTyping, chooseFields, describeStep, fieldIdentity, filledNames, nextStep, otpBoxes, quotable, secondsLeft, splitCode, totp as totpCode, TOTP_MIN_SECONDS_LEFT, urlMatches, unansweredSubmit, } from "./engine/scripted-login.js";
 import { DEFAULT_SAVE_MODE, judgeSignIn, LOOK_EVERY_MS, onApp, startWatch, } from "./engine/signed-in.js";
 /**
  * Read what the profile keeps from a signed-in context: cookies, localStorage
@@ -367,6 +367,12 @@ export function savedLine(options, saved, now = Date.now()) {
 // ── scenescout login --script ────────────────────────────────────────────────
 /** The attribute the collector tags each visible control with, so a step can act on the one it chose. */
 const TAG = "data-scenescout-login";
+/**
+ * The attribute put on each element a value is typed into. The page drawing
+ * the field again (or another page) drops it, so a later read can tell a
+ * submit the page has not answered yet from the field coming back.
+ */
+const TYPED = "data-scenescout-typed";
 /** How often the page is read while waiting for the form to move on. */
 const POLL_MS = 250;
 /**
@@ -459,6 +465,8 @@ function collectFields({ selectors, tag: tagging }) {
             maxLength: typeof input.maxLength === "number" ? input.maxLength : -1,
             filled: tag !== "button" && typeof input.value === "string" && input.value.length > 0,
             disabled: input.disabled === true,
+            // The literal, since this runs in the page: TYPED.
+            typed: el.hasAttribute("data-scenescout-typed"),
             ...(forced.has(el) ? { forced: forced.get(el) } : {}),
         });
     }
@@ -573,12 +581,16 @@ export async function runScriptedLogin(options, config, redactor, log, now = ()
             const chosen = chooseFields(fields);
             return `${pageKey()}|${Object.keys(chosen).sort().join(",")}`;
         };
-        const stepOpts = (successMatchedNow) => ({
-            hasPassword: config.password !== undefined,
-            ...(config.code ? { code: config.code.kind } : {}),
-            successConfigured: Boolean(config.success.url || config.success.selector),
-            successMatched: successMatchedNow,
-        });
+        const stepOpts = (successMatchedNow, fields) => {
+            const checking = unansweredSubmit(fields, progress.submitted);
+            return {
+                hasPassword: config.password !== undefined,
+                ...(config.code ? { code: config.code.kind } : {}),
+                successConfigured: Boolean(config.success.url || config.success.selector),
+                successMatched: successMatchedNow,
+                ...(checking ? { checking } : {}),
+            };
+        };
         /** The code to type now: the fixed one, or the TOTP code, waiting for the next one when this one is about to expire. */
         const currentCode = async (source) => {
             if (source.kind === "fixed")
@@ -591,6 +603,8 @@ export async function runScriptedLogin(options, config, redactor, log, now = ()
             return code;
         };
         const at = (f) => page.locator(`[${TAG}="${f.index}"]`);
+        /** Mark the element about to be typed into: see TYPED. */
+        const markTyped = (f) => at(f).evaluate((el, attr) => el.setAttribute(attr, ""), TYPED, { timeout: limits.actionMs });
         /** A failed action as this run's error: the time limit explained, redacted like everything else it throws. */
         const actionError = (err) => {
             const explained = loginTimeout(err, "action", limits.actionMs);
@@ -609,16 +623,27 @@ export async function runScriptedLogin(options, config, redactor, log, now = ()
         const submitOpts = { passwordless: config.password === undefined };
         let lastWait = "the sign-in form to appear";
         for (;;) {
-            if (Date.now() > deadline)
-                throw await timedOut(lastWait);
+            // Past the deadline the page is read once more, so a submit it never answered is reported as that, not as a refusal.
+            const late = Date.now() > deadline;
             const fields = await read();
             if (fields === null) {
+                if (late)
+                    throw await timedOut(lastWait);
                 await page.waitForTimeout(POLL_MS);
                 continue;
             }
             const keyAtRead = pageKey();
             const chosen = chooseFields(fields);
-            const step = nextStep(chosen, progress, stepOpts(await successMatched()));
+            const step = nextStep(chosen, progress, {
+                ...stepOpts(await successMatched(), fields),
+                ...(late ? { timedOutAfterS: config.timeoutMs / 1000 } : {}),
+            });
+            if (step.kind === "timeout") {
+                const says = await pageSays();
+                throw fail(`${step.reason} (at ${where()})${says ? `. The page says: "${says}"` : ""}`);
+            }
+            if (late && step.kind !== "refused")
+                throw await timedOut(lastWait);
             if (step.kind === "done") {
                 if (config.success.url || config.success.selector)
                     break;
@@ -630,7 +655,7 @@ export async function runScriptedLogin(options, config, redactor, log, now = ()
                 });
                 await page.waitForTimeout(POLL_MS * 2);
                 const settled = await read();
-                if (settled !== null && nextStep(chooseFields(settled), progress, stepOpts(false)).kind === "done")
+                if (settled !== null && nextStep(chooseFields(settled), progress, stepOpts(false, settled)).kind === "done")
                     break;
                 continue;
             }
@@ -673,6 +698,7 @@ export async function runScriptedLogin(options, config, redactor, log, now = ()
                             // Cleared only when it holds something: clearing sends Delete, which some boxes take as a step back to the box before.
                             if ((await at(box).inputValue({ timeout: limits.actionMs })) !== "")
                                 await at(box).fill("", { timeout: limits.actionMs });
+                            await markTyped(box);
                             // Typed as keys: a box that moves on to the next by itself, or reads keys rather than its value, still gets its character.
                             await at(box).pressSequentially(split.chars[i], { timeout: limits.actionMs });
                         }
@@ -687,6 +713,7 @@ export async function runScriptedLogin(options, config, redactor, log, now = ()
                 }
                 else {
                     const value = kind === "otp" ? await currentCode(config.code) : kind === "username" ? config.username : config.password;
+                    await markTyped(field).catch(actionFailed);
                     await at(field).fill(value, { timeout: limits.actionMs }).catch(actionFailed);
                 }
                 typedIds.set(kind, fieldIdentity(field));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.21.1",
+  "version": "3.21.3",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",