scenescout 3.23.2 → 3.23.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # scenescout
 
+## 3.23.3
+
+### Patch Changes
+
+- 43012d7: The live board's report panel keeps showing a finding's pictures when sessions in two project folders are attached at once and the session that filed the finding has closed. The report now names the project it describes, and the board loads its pictures from that folder rather than from whichever project is attached first.
+- 1cda780: The live view's run page keeps showing its pictures after a session attaches to another project folder. Its picture addresses now name the project the page was written for, so a page already open in a browser loads them from that folder rather than from whichever project attached last.
+
 ## 3.23.2
 
 ### Patch Changes

package/dist/engine/live-page.js

@@ -297,6 +297,8 @@ export const LIVE_PAGE = `<!doctype html>
   var reportKey = null;
   // Per-finding frames from api/report: empty unless the run was recorded.
   var reportEvidence = [];
+  // Where the report's pictures are served from: the project it was rendered from (api/report names it).
+  var reportFramePrefix = 'record/';
   var savedACopy = false;
   // A result that reads as a failure is shown in red.
   var BAD_RESULT = /error|fail|refus|block|violation|abandoned/i;
@@ -509,13 +511,13 @@ export const LIVE_PAGE = `<!doctype html>
       picture = el('figure', 'picture');
       picture.setAttribute('data-testid', 'live-report-picture-' + id);
       var link = el('a');
-      link.href = 'record/' + found.picture.file;
+      link.href = reportFramePrefix + found.picture.file;
       link.target = '_blank';
       link.rel = 'noreferrer';
       link.setAttribute('data-testid', 'live-report-picture-open');
       var pic = el('img');
       pic.loading = 'lazy';
-      pic.src = 'record/' + found.picture.file;
+      pic.src = reportFramePrefix + found.picture.file;
       pic.alt = 'What the finding is about, when it was filed';
       pic.addEventListener('error', function () { picture.classList.add('gone'); });
       link.appendChild(pic);
@@ -533,7 +535,7 @@ export const LIVE_PAGE = `<!doctype html>
       var fig = el('figure');
       var img = el('img');
       img.loading = 'lazy';
-      img.src = 'record/' + f.frame;
+      img.src = reportFramePrefix + f.frame;
       img.alt = f.action + ' ' + f.detail;
       // A recording deleted since the run leaves a broken icon under a finding
       // that still counts it as evidence. Say which it is.
@@ -607,7 +609,7 @@ export const LIVE_PAGE = `<!doctype html>
         var fig = el('figure', 'picture');
         var pic = el('img');
         pic.loading = 'lazy';
-        pic.src = 'record/' + m[2];
+        pic.src = reportFramePrefix + m[2];
         pic.alt = m[1];
         fig.appendChild(pic);
         container.appendChild(fig);
@@ -680,12 +682,13 @@ export const LIVE_PAGE = `<!doctype html>
         }
         reportMarkdown = d.markdown;
         reportEvidence = d.evidence || [];
+        reportFramePrefix = d.framePrefix || 'record/';
         meta.textContent = (finished ? 'as the run left it at ' : 'as the run stands at ') + clock(d.at) + ' · ' + whereItIs();
         // The report is re-read every few seconds while the run goes on.
         // Re-rendering an unchanged document threw away what the reader was
         // doing with it: an opened accordion shut itself, and the page jumped
         // back to the top, every five seconds.
-        var key = d.markdown + '\\u0000' + JSON.stringify(reportEvidence);
+        var key = d.markdown + '\\u0000' + JSON.stringify(reportEvidence) + '\\u0000' + reportFramePrefix;
         if (key === reportKey) return;
         var open = {};
         var was = doc.querySelectorAll('details[open][data-testid]');

package/dist/engine/replay.js

@@ -18,6 +18,7 @@
  * Everything here is pure string work — no browser, no filesystem — so the
  * escaping and the grouping are table-tested.
  */
+import crypto from "node:crypto";
 import path from "node:path";
 import { isSafeRelativePath } from "./plain.js";
 /** Most frames one recorded session keeps. A long run is thousands of actions, and a project folder is not a video store. */
@@ -59,6 +60,39 @@ export function resolveFrame(root, relPath) {
     const file = path.resolve(base, inside);
     return file.startsWith(base + path.sep) ? file : null;
 }
+/**
+ * A short name for a project folder, used in the live view's frame addresses so
+ * a page says which project its pictures belong to. One engine can serve runs
+ * in several folders in turn, and a page already open in a browser loads its
+ * images later, after another folder may have attached. The name is derived
+ * from the folder's resolved path and reveals nothing of it.
+ */
+export function projectKey(dir) {
+    return "p-" + crypto.createHash("sha256").update(path.resolve(dir)).digest("hex").slice(0, 12);
+}
+/** A frame address split into the project it names, when it names one, and the path inside that project's recordings. */
+export function splitProjectFrame(relPath) {
+    const m = /^(p-[0-9a-f]{12})\/(.+)$/.exec(relPath);
+    return m ? { key: m[1], rest: m[2] } : { rest: relPath };
+}
+/**
+ * The project folders this process has rendered a run page or a board report
+ * for, by key. Only a folder one was rendered from can be named, so a viewer
+ * cannot reach any other folder by guessing a key.
+ */
+export class ProjectDirs {
+    byKey = new Map();
+    /** Remember `dir` and return its key. */
+    remember(dir) {
+        const key = projectKey(dir);
+        this.byKey.set(key, dir);
+        return key;
+    }
+    /** The folder a key names, or undefined when nothing was rendered from one with that key. */
+    dir(key) {
+        return this.byKey.get(key);
+    }
+}
 /** Text from the app under test reaches this document, so nothing is interpolated unescaped. */
 export function escapeHtml(text) {
     return text.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);

package/dist/engine/report.js

@@ -4,7 +4,7 @@ import { baseRoute, reachedRoutes, routeIdentity, isEmbedKey, isWorthALook, judg
 import { sayVerification } from "./verify.js";
 import { describePicture, readFindingPicture } from "./capture.js";
 import { feedForSession } from "./live.js";
-import { buildReplayHtml, evidenceFor } from "./replay.js";
+import { buildReplayHtml, evidenceFor, projectKey } from "./replay.js";
 import { calibrate, formatCalibration } from "./calibration.js";
 import { formatPace, measurePace } from "./pace.js";
 import { formatNeverSubmittedEmpty } from "./forms.js";
@@ -221,7 +221,8 @@ export function replayDocument(memory, markdown, version = "") {
         project: projectName(memory.dir),
         at: new Date().toISOString(),
         version,
-        framePrefix: "record/",
+        // Keyed by project, so the page's pictures still load after a session attaches to another folder (replay.ts).
+        framePrefix: `record/${projectKey(memory.dir)}/`,
         savedAt: memory.dir,
     });
 }

package/dist/mcp-server.js

@@ -70,7 +70,7 @@ import { CRITERION_VERDICTS, findCriterion, formatCriteriaForLanes, formatReadin
 import { ACTION_TIMEOUT_ENV, DEFAULT_ACTION_TIMEOUT_MS, DEFAULT_CRAWL_NAV_TIMEOUT_MS, DEFAULT_NAV_TIMEOUT_MS, LIMIT_BOUNDS, NAV_TIMEOUT_ENV, watchdogFor, } from "./engine/limits.js";
 import { MAX_READ_POSTS, READ_POSTS_ENV } from "./engine/policy.js";
 import { chooseProjectFolder, PROJECTS_DIR_ENV, workspaceFromRoots } from "./engine/project-folder.js";
-import { RECORD_MAX_FRAMES, resolveFrame } from "./engine/replay.js";
+import { ProjectDirs, RECORD_MAX_FRAMES, resolveFrame, splitProjectFrame } from "./engine/replay.js";
 import { describePace, normalizePace } from "./engine/settle.js";
 import { needsTask, taskRefusal, TASK_MAX } from "./engine/task.js";
 import { formElicitationSupported, INTAKE_FORM_MESSAGE, INTAKE_TOOL, intakeFormSchema, intakeFromForm, intakeReplyText } from "./intake.js";
@@ -149,6 +149,8 @@ let liveError = null;
  * found — which is the moment somebody most wants to read it.
  */
 let lastRun = null;
+/** Every project folder a run page or the board's report has been rendered from, so their pictures resolve against it later (#457, #463). */
+const pageProjects = new ProjectDirs();
 /** Render the report for a session that is about to close, so the live view keeps it. */
 function keepReport(eng) {
     if (!eng.memory)
@@ -167,6 +169,7 @@ function keepReport(eng) {
     }
     try {
         lastRun.evidence = reportEvidence(eng.memory);
+        pageProjects.remember(eng.memory.dir);
         lastRun.replay = replayDocument(eng.memory, lastRun.markdown, PKG_VERSION);
     }
     catch (err) {
@@ -185,6 +188,10 @@ function reportFile(dir) {
         return { path: file, written: false };
     }
 }
+/** The address a report's frames start with: keyed by project, and the folder is remembered so the key resolves (#463). */
+function framePrefixFor(dir) {
+    return `record/${pageProjects.remember(dir)}/`;
+}
 const liveProvider = {
     snapshot: () => ({
         pid: process.pid,
@@ -204,9 +211,14 @@ const liveProvider = {
     report: () => {
         const eng = (lastWriter && engines.get(lastWriter.session)) ?? engines.values().next().value;
         if (!eng?.memory)
-            return lastRun ? { markdown: lastRun.markdown, at: lastRun.at, evidence: lastRun.evidence } : null;
+            return lastRun ? { markdown: lastRun.markdown, at: lastRun.at, evidence: lastRun.evidence, framePrefix: framePrefixFor(lastRun.dir) } : null;
         const { markdown } = generateReport(eng.memory, eng.oracleLog.all, reportExtras(eng), { write: false });
-        return { markdown: redactSecrets(markdown), at: new Date().toISOString(), evidence: reportEvidence(eng.memory) };
+        return {
+            markdown: redactSecrets(markdown),
+            at: new Date().toISOString(),
+            evidence: reportEvidence(eng.memory),
+            framePrefix: framePrefixFor(eng.memory.dir),
+        };
     },
     /**
      * The whole run as one page, served at its own address. The live view sends
@@ -219,6 +231,7 @@ const liveProvider = {
             return lastRun?.replay || null;
         try {
             const { markdown } = generateReport(eng.memory, eng.oracleLog.all, reportExtras(eng), { write: false });
+            pageProjects.remember(eng.memory.dir);
             return replayDocument(eng.memory, redactSecrets(markdown), PKG_VERSION);
         }
         catch (err) {
@@ -233,12 +246,19 @@ const liveProvider = {
      * comes from a viewer, so it is resolved and then required to still be
      * inside that directory: nothing else in the project is reachable this way.
      */
-    frame: async (relPath) => {
-        // Sessions may hold different project directories, so the frame belongs to
-        // the session its own path names — not to whichever engine happens to be
-        // first. Falling back keeps a finished run's frames reachable.
-        const named = relPath.replace(/^recordings[\\/]/, "").split("/")[0];
-        const dir = engines.get(named)?.memory?.dir ?? engines.values().next().value?.memory?.dir ?? lastRun?.dir;
+    frame: async (address) => {
+        // A run page names the project it was rendered from, so its pictures load
+        // after a session attaches to another folder. The live board's own frames
+        // carry no project: they belong to the session their path names, and
+        // falling back keeps a finished run's frames reachable.
+        const { key, rest: relPath } = splitProjectFrame(address);
+        let dir;
+        if (key)
+            dir = pageProjects.dir(key);
+        else {
+            const named = relPath.replace(/^recordings[\\/]/, "").split("/")[0];
+            dir = engines.get(named)?.memory?.dir ?? engines.values().next().value?.memory?.dir ?? lastRun?.dir;
+        }
         if (!dir)
             return null;
         const file = resolveFrame(path.join(dir, "recordings"), relPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.23.2",
+  "version": "3.23.3",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",