scenescout 3.23.3 → 3.23.4

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # scenescout
 
+## 3.23.4
+
+### Patch Changes
+
+- 83d639e: The live view's token files are now always owner-only: a token file left in the project with wider permissions, or a link left at its name, is replaced rather than written through.
+- ca10b22: Typed passwords and other secret fields are now masked in logs, reports and exported issues. A value typed into a password field, a field whose `autocomplete` marks a credential, a one-time code or a card, or a field whose name or label says so, is shown as `•••• (masked: password field)` in the tool's result, the action log, memory, the report, the live view's feed and a finding's steps, and so is what the field held before. Text the run keeps is also cleared of email addresses and card numbers, of a value typed after a label that names a secret, whatever its length, and of the value of a parameter named for a secret (`?password=…`, `?pin=…`).
+- a2fd38f: The `/scenescout qa` reply no longer lets a finding's title, a journey's name or anything else from the run render as maths (`$…$`), reference an issue or pull request (`#12`, `GH-12`, `owner/repo/issues/12`), or reorder the line with bidirectional control characters. GitHub acted on these even when backslash-escaped; the reply now breaks each with a zero-width space, so what the reader sees is unchanged. Names shown as code (the branch, the workflow, the artifact) drop bidirectional and C1 control characters too.
+- d1d2efc: The check replay page redacts email addresses and card numbers in the paths, captions, expectations and failure reasons it shows, as it already did for secrets in addresses. Addresses on reserved example domains and digit runs that are not card numbers stay readable.
+- 67fcab7: The live view's run page escapes the saved report's path where its script names it, so a project folder whose name contains `</script>` can no longer end that script early.
+- b2b1481: Refresh the transitive dependencies of the MCP SDK (express, hono, jose and others) within their existing ranges. No change in behaviour.
+
 ## 3.23.3
 
 ### Patch Changes

package/README.md

@@ -1,6 +1,8 @@
 <div align="center">
 
-# 🔭 SceneScout
+<img src="site/favicon.svg" alt="" width="88" height="88" />
+
+# SceneScout
 
 **Your coding agent, turned into an exploratory QA tester for any web app.**
 
@@ -11,7 +13,7 @@ Works with Claude Code · Cursor · VS Code (Copilot) · Codex CLI · Gemini CLI
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 ![node >= 20](https://img.shields.io/badge/node-%E2%89%A5%2020-339933?logo=node.js&logoColor=white)
 
-[📖 Guide](docs/guide/Home.md) · [🐛 What it catches](#-what-it-catches) · [🎬 QA with evidence](#-automated-qa-with-evidence) · [🚀 Get started](#-get-started) · [🚦 CI](#-in-ci) · [🔒 Safety](#-safe-by-default) · [📚 Docs](#-documentation)
+[🌐 Website](https://brunoboto96.github.io/SceneScout/) · [📖 Guide](docs/guide/Home.md) · [🐛 What it catches](#-what-it-catches) · [🎬 QA with evidence](#-automated-qa-with-evidence) · [🚀 Get started](#-get-started) · [🚦 CI](#-in-ci) · [🔒 Safety](#-safe-by-default) · [📚 Docs](#-documentation)
 
 </div>
 
@@ -134,7 +136,7 @@ Everything is one self-contained HTML page per report, with no scripts, nothing
 
 Each exploratory run opens a live view on your machine, with one card per agent: what it is doing, the page it is on, and a feed of every action. Three agents are testing the demo app in parallel here:
 
-<p align="center"><img src="examples/screenshots/live-view.png" alt="The live view during a run of three parallel agents against the demo app: one card per session, each with its role and objective, the task it is on, the tool it is running, the page it is on, a live thumbnail, and a feed of the actions it just took, tinted one colour per task" width="880" /></p>
+<p align="center"><img src="examples/screenshots/live-view.png" alt="The live view during a run of three parallel agents against the demo app, every one streaming its page live: one card per session, each with its role and objective, the task it is on, the tool it is running, a live picture of its page, and a feed of the actions it just took, tinted one colour per task" width="880" /></p>
 
 You can read the report while the agents are still working, and scrub back through any session's timeline. Beside `report.md`, every run writes `report.html`, the whole run as one self-contained page; ask for a recorded run and it also keeps a frame after every action.
 
@@ -218,6 +220,21 @@ A gate on every pull request that keeps its evidence, as a GitHub Action:
 
 [docs/ci.md](docs/ci.md) has complete workflows, every option, and the same check on GitLab CI, CircleCI or any shell.
 
+### Ask for it on a pull request
+
+Type a command in a pull request comment and SceneScout answers in the thread, with pictures taken by a real browser:
+
+| Comment | Reply |
+|---|---|
+| `/scenescout qa` | Explores the pull request's preview and replies with what it found |
+| `/scenescout qa show the Save button` | A picture of that element |
+| `/scenescout qa compare the Save button` | The element on the base and on the pull request, with the changed pixels highlighted |
+| `/scenescout qa check` | Runs your saved journeys on the branch and replies with each one's result; the video of every journey is in the run's files |
+
+<p align="center"><img src="examples/screenshots/pr-qa-compare.png" alt="A pull request comment, /scenescout qa compare the Save button, and SceneScout's reply: the button on the base branch in blue and on the pull request in green, with 61.2% of pixels changed highlighted" width="520" /></p>
+
+The preview commands test a deployed preview, so the pull request's code never runs beside the model's key; `qa check` runs your own workflow and uses no key. [Setting it up](docs/ci.md#a-qa-review-from-a-pull-request-comment).
+
 ## 🔒 Safe by default
 
 | Mode | What may leave the page |

package/dist/browsers.js

@@ -15,10 +15,10 @@ export const BROWSER_ENGINES = ["chromium", "firefox", "webkit"];
  * a headed run opens, and the headless shell, which every headless run uses.
  * Installing "chromium" brings both, which is what install has always done.
  */
-export const INSTALL_TARGETS = ["chromium", "chromium-headless-shell", "firefox", "webkit"];
-export const DEFAULT_ENGINE = "chromium";
+const INSTALL_TARGETS = ["chromium", "chromium-headless-shell", "firefox", "webkit"];
+const DEFAULT_ENGINE = "chromium";
 /** Environment variable naming the browser an attach uses when it does not name one. */
-export const DEFAULT_ENGINE_ENV = "SCENESCOUT_BROWSER";
+const DEFAULT_ENGINE_ENV = "SCENESCOUT_BROWSER";
 /** Approximate size on disk, so the install output can say what it is about to fetch. */
 export const APPROX_DISK_MB = {
     chromium: 550,
@@ -124,7 +124,7 @@ export function browserPresence(executables, exists = fs.existsSync) {
     };
 }
 /** The command that downloads one build, for the way this copy of SceneScout was installed. */
-export function installCommandFor(target, fromCheckout) {
+function installCommandFor(target, fromCheckout) {
     const flags = `--browser-only --browsers ${target}`;
     return fromCheckout ? `node dist/cli.js install ${flags}` : `npx -y scenescout install ${flags}`;
 }
@@ -260,6 +260,7 @@ export function writeRedirectHopsJudged(engine) {
  * the policy blocks nothing and the person has opted in to everything.
  */
 export const REMOVE_SHARED_WORKER_SCRIPT = `(() => {
+  // Runs before the page's scripts, so the page cannot have locked the property. WebIDL makes it configurable, so the delete works in every engine and the redefinition is only a fallback; neither is expected to throw, and a throw must not stop the page loading.
   try { delete globalThis.SharedWorker; } catch {}
   if ("SharedWorker" in globalThis) {
     try { Object.defineProperty(globalThis, "SharedWorker", { value: undefined, configurable: true, writable: true }); } catch {}
@@ -287,8 +288,8 @@ export function defaultAttachNote(opts) {
 /** Environment variable deciding whether an attach downloads a missing browser build itself. */
 export const BROWSER_DOWNLOAD_ENV = "SCENESCOUT_BROWSER_DOWNLOAD";
 /** `auto` downloads except in CI; `on` downloads in CI too; `off` never downloads, for a machine where nothing may be fetched. */
-export const BROWSER_DOWNLOAD_SETTINGS = ["auto", "on", "off"];
-export const DEFAULT_BROWSER_DOWNLOAD = "auto";
+const BROWSER_DOWNLOAD_SETTINGS = ["auto", "on", "off"];
+const DEFAULT_BROWSER_DOWNLOAD = "auto";
 /**
  * What an attach does when the build it needs is not on disk: download it
  * itself, refuse because the setting says never, or tell CI to keep its

package/dist/ci-run.js

@@ -35,7 +35,7 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 const packageRoot = path.resolve(here, "..");
 const serverPath = path.join(packageRoot, "dist", "mcp-server.js");
 /** The longest one attempt at a model call may take. An attempt that runs longer, with wall time left, is retried like a server error. */
-export const MODEL_CALL_MS = 180_000;
+const MODEL_CALL_MS = 180_000;
 /** Retries of one model call after its first attempt. */
 export const MAX_RETRIES = 3;
 /**
@@ -44,7 +44,7 @@ export const MAX_RETRIES = 3;
  * the browser share this one budget, so a run ends at most this long after
  * its time cap, plus the few seconds the files take.
  */
-export const FINISH_MS = 180_000;
+const FINISH_MS = 180_000;
 /** Attaching before the exploration, which counts towards the time cap. */
 const ATTACH_MS = 120_000;
 /** Tool calls run from one model reply; any beyond are answered as not run. Bounds what one turn can spend. Set here only. */
@@ -947,6 +947,7 @@ export async function runCi(options, resolved, deps) {
             await host
                 .call("scout_close", { all: true }, finishLeft())
                 .catch((err) => log(`Closing the browser failed: ${err instanceof Error ? err.message : String(err)}`));
+            // The run is over and its outcome decided; a host that fails to close adds nothing to report.
             await host.close().catch(() => { });
         }
     }

package/dist/cli.js

@@ -330,7 +330,8 @@ function watch(projectPath, open) {
     if (!open)
         return;
     const { command, args } = browserOpener(target.url);
-    const result = spawnSync(command, args, { stdio: "ignore" });
+    // An opener that never returns (no desktop session) must not hold the command; the address is printed above either way.
+    const result = spawnSync(command, args, { stdio: "ignore", timeout: 10_000 });
     if (result.error || result.status !== 0)
         console.log("Could not open a browser from here. Open the address above yourself.");
 }

package/dist/clients.js

@@ -13,8 +13,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import { MCP_NAME } from "./installer.js";
-export const OTHER_CLIENTS = ["cursor", "vscode", "codex", "gemini", "copilot", "windsurf"];
-export const CLIENTS = ["claude-code", ...OTHER_CLIENTS];
+const OTHER_CLIENTS = ["cursor", "vscode", "codex", "gemini", "copilot", "windsurf"];
+const CLIENTS = ["claude-code", ...OTHER_CLIENTS];
 export const CLIENT_LABELS = {
     "claude-code": "Claude Code",
     cursor: "Cursor",
@@ -55,7 +55,7 @@ const STRATEGIES = {
 };
 const quote = (s) => (/^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`);
 /** The entry every `mcpServers`-style file takes. */
-export function serverEntry(launch) {
+function serverEntry(launch) {
     return { command: launch[0], args: launch.slice(1) };
 }
 /**

package/dist/code-routes.js

@@ -183,7 +183,7 @@ export function readRouteObjects(src) {
  * The source with comments blanked out, offsets preserved. `<Route>` tags are
  * found by pattern, so a commented-out route would otherwise be read as live.
  */
-export function maskComments(src) {
+function maskComments(src) {
     const out = src.split("");
     let i = 0;
     const blank = (from, to) => {
@@ -268,7 +268,7 @@ export function readRouteElements(source) {
 }
 const tidy = (p) => `/${p}`.replace(/\/+/g, "/").replace(/(.)\/$/, "$1");
 /** The absolute path of one record, or null when it (or an ancestor) is a wildcard. */
-export function recordPath(records, idx, prefix = "", absoluteTopOnly = false) {
+function recordPath(records, idx, prefix = "", absoluteTopOnly = false) {
     const r = records[idx];
     if (/[*]/.test(r.path))
         return null;

package/dist/commands.js

@@ -43,11 +43,11 @@ export const HAND_PARSED = {
     watch: { switches: ["--no-open"], valued: [], positional: 1 },
 };
 /** True when the arguments ask for help. */
-export function wantsHelp(args) {
+function wantsHelp(args) {
     return args.includes("--help") || args.includes("-h");
 }
 /** The first argument `spec` does not accept, as an error sentence; null when every one is accepted. */
-export function unknownArgument(args, spec) {
+function unknownArgument(args, spec) {
     let positional = 0;
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -71,7 +71,7 @@ export function unknownArgument(args, spec) {
     return null;
 }
 /** Whether `command` names a subcommand. */
-export function isSubcommand(command) {
+function isSubcommand(command) {
     return command !== undefined && Object.hasOwn(HANDLERS_OF, command);
 }
 /** A host with no scheme: a name or address, an optional port, then optionally a path, query or fragment. */
@@ -103,7 +103,7 @@ export function looksLikeUrl(arg) {
     return host.includes(".") || host.includes(":") || host.toLowerCase() === "localhost";
 }
 /** Settle help and flag errors for a subcommand before its handler is reached. */
-export function preflight(command, args) {
+function preflight(command, args) {
     if (wantsHelp(args))
         return { kind: "help" };
     const spec = Object.hasOwn(HAND_PARSED, command) ? HAND_PARSED[command] : undefined;

package/dist/engine/args.js

@@ -0,0 +1,21 @@
+/**
+ * The one rule for a valued command-line option, shared by the parsers of
+ * `check`, `ci` and `export`: `--name value` or `--name=value`, and a value
+ * that is missing or looks like the next option is a mistake, not a value.
+ * Each parser keeps its own rules for which names exist and which are switches.
+ */
+/** The option name in `--name` or `--name=value`. */
+export function flagName(arg) {
+    const eq = arg.indexOf("=");
+    return eq > 0 ? arg.slice(2, eq) : arg.slice(2);
+}
+/** The value of the option at `args[i]` and the index of the last argument it used. */
+export function readFlagValue(args, i) {
+    const a = args[i];
+    const eq = a.indexOf("=");
+    const name = flagName(a);
+    const value = eq > 0 ? a.slice(eq + 1) : args[i + 1];
+    if (value === undefined || (eq < 0 && value.startsWith("--")))
+        return { ok: false, error: `--${name} needs a value` };
+    return { ok: true, name, value, last: eq < 0 ? i + 1 : i };
+}

package/dist/engine/bench.js

@@ -337,7 +337,7 @@ function lanePaths(lane, laneRoutes) {
  * any lane that reported no route — the wording rule decides, unchanged, so
  * those runs score as they always have.
  */
-export function ownershipRemark(d, key, laneRoutes) {
+function ownershipRemark(d, key, laneRoutes) {
     if (d.verdict !== "not_a_defect")
         return null;
     const own = lanePaths(d.lane, laneRoutes);

package/dist/engine/brief.js

@@ -26,7 +26,7 @@ import { normalizePath } from "./fingerprint.js";
 /** Most lanes worth running at once. Past this the planner spends longer reading reports than the lanes spend testing. */
 export const MAX_LANES = 8;
 /** A lane name is a session name: short, and it shows in the live view. */
-export const LANE_NAME_MAX = 40;
+const LANE_NAME_MAX = 40;
 /**
  * The module a route belongs to: its first path segment, or "/" for the root.
  *

package/dist/engine/browser.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { elementKey, fingerprintState, isNonPageRoute, keyAliasSteps, normalizePath, ordinalKeys, refsSurviveUrlChange, routeBase, } from "./fingerprint.js";
 import { AUTH_LOSS_PREFIX, JOURNEY_END, JOURNEY_START, MemoryStore, NAME_RULE, reachedRoutes, redactSecrets, TASK_SET, } from "./memory.js";
+import { maskedValue, maskFillCalls, secretFieldKind } from "./sensitive.js";
 import { normalizeTask } from "./task.js";
 import { ACTED_CONTROL_SRC, CLAIM_SCAN_SCRIPT, findContradictions, INFRASTRUCTURE_WRITE_RE, isBackgroundRequest, OPEN_DIALOGS_SCRIPT, quietAnswer, saidSince, } from "./claims.js";
 import { POSTMESSAGE_BINDING, describeTokenPost, postMessageCaptureScript, tokenHits, tokenPostKey } from "./postmessage.js";
@@ -3092,26 +3093,60 @@ export class BrowserEngine {
      * testing), and reading the existing content is load-bearing: if it fails,
      * the action aborts rather than risk a silent content-destroying replace.
      */
-    async fillOrAppend(locator, text, replace) {
+    async fillOrAppend(locator, text, replace, label = "") {
         let state;
         try {
             state = (await locator.evaluate((node) => {
                 const n = node;
                 const type = n.tagName === "INPUT" ? n.type.toLowerCase() : "";
+                // What the page says about the field, for sensitive.ts to decide whether its value is a secret.
+                const byIds = (ids) => (ids ?? "")
+                    .split(/\s+/)
+                    .map((id) => (id ? (document.getElementById(id)?.textContent ?? "") : ""))
+                    .join(" ");
+                const facts = {
+                    type: n.getAttribute("type"),
+                    autocomplete: n.getAttribute("autocomplete"),
+                    name: n.getAttribute("name"),
+                    id: n.id || null,
+                    placeholder: n.getAttribute("placeholder"),
+                    maxLength: typeof n.maxLength === "number" && n.maxLength >= 0 ? n.maxLength : null,
+                    labels: [
+                        n.getAttribute("aria-label") ?? "",
+                        byIds(n.getAttribute("aria-labelledby")),
+                        ...Array.from(n.labels ?? []).map((l) => l.textContent ?? ""),
+                    ].filter((t) => t.trim() !== ""),
+                };
                 if (n.isContentEditable)
-                    return { existing: (n.innerText || n.textContent || "").trim(), caretAppendable: true, type };
+                    return { existing: (n.innerText || n.textContent || "").trim(), caretAppendable: true, type, facts };
                 if (typeof n.value === "string") {
                     // selectionStart is null on number/date/email-style inputs — caret
                     // placement is unsupported there, so append must go via fill().
-                    return { existing: n.value, caretAppendable: typeof n.selectionStart === "number", type };
+                    return { existing: n.value, caretAppendable: typeof n.selectionStart === "number", type, facts };
                 }
-                return { existing: "", caretAppendable: false, type };
+                return { existing: "", caretAppendable: false, type, facts };
             }, undefined, { timeout: this.limits.actionMs }));
         }
         catch (err) {
             throw new Error(`Could not read the field's existing content before typing — aborting rather than risk overwriting it (${err instanceof Error ? err.message.split("\n")[0] : err}). Take a new scout_snapshot and retry.`);
         }
+        const { facts, existing } = state;
+        // A secret field's value, and what it held before, are never quoted: the note goes to the log, the report and exported issues.
+        const secret = secretFieldKind({ ...facts, label: [label, ...facts.labels] });
+        try {
+            return { note: await this.writeField(locator, text, replace, state, secret), secret };
+        }
+        catch (err) {
+            // Playwright's call log quotes the value it was asked to fill.
+            if (secret && err instanceof Error)
+                err.message = maskFillCalls(err.message, [text, existing, existing + text]);
+            throw err;
+        }
+    }
+    /** fillOrAppend's write, once the field has been read; returns the note. */
+    async writeField(locator, text, replace, state, secret) {
         const { existing, caretAppendable, type } = state;
+        const quoted = (value) => (secret ? `(masked: ${secret} field)` : JSON.stringify(value.slice(0, 60)));
         if (APP_FILLED_TYPES.has(type)) {
             // A date or time field holds one value in one format: anything else is
             // refused by the browser as a bare "Malformed value", and appending to
@@ -3119,16 +3154,17 @@ export class BrowserEngine {
             // field's format, or refused naming it, and always replaces.
             const date = normaliseDateValue(type, text);
             if ("refused" in date)
-                throw new Error(`Not typed: ${date.refused}`);
+                throw new Error(`Not typed: ${secret ? date.refused.replace(JSON.stringify(text), "the value") : date.refused}`);
             await locator.fill(date.value, { timeout: this.limits.actionMs });
-            return ((date.note ? ` (${date.note})` : "") +
-                (existing && existing !== date.value ? ` (replaced existing content ${JSON.stringify(existing.slice(0, 60))}: a ${type} field holds one value)` : ""));
+            const note = (date.note && !secret ? ` (${date.note})` : "") +
+                (existing && existing !== date.value ? ` (replaced existing content ${quoted(existing)}: a ${type} field holds one value)` : "");
+            return note;
         }
         if (replace || !existing || text === "") {
             await locator.fill(text, { timeout: this.limits.actionMs });
-            return existing && (replace || text === "") ? ` (replaced existing content ${JSON.stringify(existing.slice(0, 60))})` : "";
+            return existing && (replace || text === "") ? ` (replaced existing content ${quoted(existing)})` : "";
         }
-        const appendNote = ` (APPENDED after existing content ${JSON.stringify(existing.slice(0, 60))} — pass replace=true to overwrite instead)`;
+        const appendNote = ` (APPENDED after existing content ${quoted(existing)} — pass replace=true to overwrite instead)`;
         if (!caretAppendable) {
             // Data-typed inputs (number, email, date): concatenate without a
             // separator — an injected space would invalidate the value.
@@ -3188,7 +3224,8 @@ export class BrowserEngine {
         // the element afterwards. Never for another site's frame: no probe is placed there.
         if (!embed)
             await this.noteProbe(text, `${el.role} "${el.name}"`);
-        let fillNote = await this.fillOrAppend(locator, text, replace);
+        const filled = await this.fillOrAppend(locator, text, replace, el.name);
+        let fillNote = filled.note;
         // What another site's field already held is its business, not the report's.
         if (embed)
             fillNote = fillNote.replace(/existing content "(?:[^"\\]|\\.)*"/g, "existing content (masked: another site's frame)");
@@ -3214,7 +3251,9 @@ export class BrowserEngine {
             this.noteFormSubmit(formState, "enter", form);
         }
         this.memory.markExercised(this.currentFingerprint, el.key, "type");
-        return this.afterAction("type", `${el.role} "${el.name}" ← ${JSON.stringify(text.slice(0, 60))}${pressEnter ? " + Enter" : ""}${fillNote}`);
+        // A secret field's value is never written down, not even its length; clearing one ("") reveals nothing.
+        const shown = filled.secret && text !== "" ? maskedValue(filled.secret) : JSON.stringify(text.slice(0, 60));
+        return this.afterAction("type", `${el.role} "${el.name}" ← ${shown}${pressEnter ? " + Enter" : ""}${fillNote}`);
     }
     /**
      * Attach a file to an upload control the way a user does. `ref` may be the
@@ -4758,7 +4797,8 @@ export class BrowserEngine {
             // A navigation or a scroll is not input: navigate() moves the action mark itself, and what a scroll loads is the page's own doing.
             if (step.action !== "navigate" && step.action !== "scroll")
                 await this.beginInput();
-            const desc = `${i + 1}. ${step.action} ${step.target ?? step.value ?? ""}`;
+            // A type step is described by its target, never its value: the value may be a password.
+            const desc = `${i + 1}. ${step.action} ${step.target ?? (step.action === "type" ? "(no target)" : (step.value ?? ""))}`;
             // Identity captured BEFORE the action — buttons that relabel themselves
             // (Add to Cart → View Cart) are unmatchable in the post-action DOM.
             let preTestid = null;
@@ -4868,8 +4908,7 @@ export class BrowserEngine {
                     }
                     else if (step.action === "type") {
                         await this.noteProbe(step.value ?? "", step.target ?? "the field");
-                        const fillNote = await this.fillOrAppend(loc, step.value ?? "", step.replace ?? false);
-                        note = fillNote;
+                        note = (await this.fillOrAppend(loc, step.value ?? "", step.replace ?? false, label)).note;
                         if (step.pressEnter) {
                             if (this.readOnly) {
                                 const submit = loc.locator("xpath=ancestor::form[1]").locator('[type="submit"], button:not([type="button"]):not([type="reset"])').first();
@@ -4909,7 +4948,12 @@ export class BrowserEngine {
                 // steps are where most of a recorded run actually happens. Leaving
                 // them unframed reproduced, inside run_plan, the same hole that crawl
                 // had: a form filled and submitted with no picture of any of it.
-                this.logAction({ action: `plan:${step.action}`, target: step.target ?? step.value, url: page.url(), ...(await this.frameFor(`plan-${step.action}`)) });
+                this.logAction({
+                    action: `plan:${step.action}`,
+                    target: step.target ?? (step.action === "type" ? undefined : step.value),
+                    url: page.url(),
+                    ...(await this.frameFor(`plan-${step.action}`)),
+                });
                 // Plans must feed coverage like ref-based actions do: record the
                 // state and mark the acted-on element class as exercised.
                 // Hover is deliberately excluded: a hover is a look, not an

package/dist/engine/capture.js

@@ -63,7 +63,7 @@ export function capturedName(file) {
         return null;
     return name.slice(0, -".png".length);
 }
-export const CAPTURED_PREFIX = "CAPTURED ";
+const CAPTURED_PREFIX = "CAPTURED ";
 /** scout_capture's result: a line for whoever reads it, then the details as one line of JSON. */
 export function captureResultText(info) {
     return (`Saved a ${info.width}×${info.height} picture of ${info.label ? `"${info.label.replace(/\s+/g, " ")}"` : info.key} on ${info.url} to ${info.file}.\n` +
@@ -147,9 +147,9 @@ export const SHOTS_DIRNAME = "shots";
  */
 export const EVIDENCE_MODES = ["inline", "file", "off"];
 export const EVIDENCE_ENV = "SCENESCOUT_EVIDENCE";
-export const EVIDENCE_MAX_PX_ENV = "SCENESCOUT_EVIDENCE_MAX_PX";
-export const EVIDENCE_MAX_KB_ENV = "SCENESCOUT_EVIDENCE_MAX_KB";
-export const EVIDENCE_INLINE_ENV = "SCENESCOUT_EVIDENCE_INLINE";
+const EVIDENCE_MAX_PX_ENV = "SCENESCOUT_EVIDENCE_MAX_PX";
+const EVIDENCE_MAX_KB_ENV = "SCENESCOUT_EVIDENCE_MAX_KB";
+const EVIDENCE_INLINE_ENV = "SCENESCOUT_EVIDENCE_INLINE";
 export const RECORD_ENV = "SCENESCOUT_RECORD";
 /**
  * The bounds a finding's picture is held to, and their defaults. The longer

package/dist/engine/check-replay.js

@@ -34,7 +34,7 @@ function shotFields(shot) {
     return shot?.pastCap ? { pastCap: true } : {};
 }
 /** What a step should bring about: its own `expected`, else an expect-* step's assertion, else nothing. */
-export function expectedOf(step) {
+function expectedOf(step) {
     if (step.expected !== undefined)
         return step.expected;
     return step.action.startsWith("expect-") ? describeStep(step) : undefined;
@@ -116,21 +116,95 @@ export function capFrames(replay, max = replay.frameCap ?? RECORD_MAX_FRAMES) {
     });
     return { ...replay, roles, framesLeftOut: leftOut, frameCap: max };
 }
-/** The report's redaction (memory.ts redactRoute) on every path, caption and reason the page shows. */
+/** Domains reserved for documentation (RFC 2606 / 6761) name nobody, so an address on one stays readable. */
+const RESERVED_DOMAIN_RE = /^(?:[\p{L}\p{N}-]+\.)*(?:example\.(?:com|org|net)|example|test|invalid|localhost)$/iu;
+/** An image's pixel-density suffix (`@2x` before its extension), which reads like an address but is a file name. */
+const DENSITY_DOMAIN_RE = /^\d+(?:\.\d+)?x\./i;
+/**
+ * An address in any script, its @ written out or percent-encoded (`%40`), as a
+ * path's query string carries it. Group 1 is the domain.
+ */
+const EMAIL_RE = /[\p{L}\p{N}._%+-]+(?:@|%40)([\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)*\.(?:\p{L}{2,}|xn--[a-z0-9-]+))/giu;
+/** A run of digit groups split by single spaces or hyphens; a card number is some of its groups. */
+const DIGIT_RUN_RE = /(?<![\d.])\d+(?:[ -]\d+)*/g;
+/** A card number's first digit: the networks issue from 2 to 6 and 8, so a millisecond timestamp (a leading 1) is never one. */
+const CARD_FIRST_DIGIT_RE = /^[2-68]/;
+function luhnValid(digits) {
+    let sum = 0;
+    for (let i = 0; i < digits.length; i++) {
+        let d = Number(digits[digits.length - 1 - i]);
+        if (i % 2 === 1) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+    }
+    return sum % 10 === 0;
+}
+/**
+ * Personal data a page or a flow can put in text the report shows: an email
+ * address, its @ written out or percent-encoded (a reserved example address
+ * and an image's `@2x` name excepted), and a card number (digits that start as
+ * a card network's do and pass the Luhn check, so an order number or a
+ * timestamp stays).
+ */
+export function redactPersonal(text) {
+    return text
+        .replace(EMAIL_RE, (m, domain) => (RESERVED_DOMAIN_RE.test(domain) || DENSITY_DOMAIN_RE.test(domain) ? m : "[email redacted]"))
+        .replace(DIGIT_RUN_RE, redactCardsInRun);
+}
+function isCardNumber(digits) {
+    return digits.length >= 13 && digits.length <= 19 && CARD_FIRST_DIGIT_RE.test(digits) && luhnValid(digits);
+}
+/**
+ * The card numbers among a run's digit groups, each the longest that starts at
+ * its group, so a date or a quantity written just before a card number does
+ * not hide it. A group is never split: digits inside a longer id stay.
+ */
+function redactCardsInRun(run) {
+    const parts = run.split(/([ -])/);
+    const groups = parts.filter((_, i) => i % 2 === 0);
+    let out = "";
+    let i = 0;
+    while (i < groups.length) {
+        let end = -1;
+        let digits = "";
+        for (let j = i; j < groups.length && digits.length + groups[j].length <= 19; j++) {
+            digits += groups[j];
+            if (isCardNumber(digits))
+                end = j;
+        }
+        if (i > 0)
+            out += parts[2 * i - 1];
+        if (end === -1) {
+            out += groups[i];
+            i += 1;
+        }
+        else {
+            out += "[card number redacted]";
+            i = end + 1;
+        }
+    }
+    return out;
+}
+/** Secrets in addresses (memory.ts redactRoute) and personal data (redactPersonal), for any text the page shows. */
+const redactText = (text) => redactPersonal(redactRoute(text));
+/** The report's redaction on every path, caption and reason the page shows. */
 export function redactReplay(replay) {
     return {
         ...replay,
         roles: replay.roles.map((role) => ({
             ...role,
-            visits: role.visits.map((v) => ({ ...v, path: redactRoute(v.path), ...(v.reason !== undefined ? { reason: redactRoute(v.reason) } : {}) })),
+            visits: role.visits.map((v) => ({ ...v, path: redactText(v.path), ...(v.reason !== undefined ? { reason: redactText(v.reason) } : {}) })),
             journeys: role.journeys.map((j) => ({
                 ...j,
                 steps: j.steps.map((s) => ({
                     ...s,
-                    caption: redactRoute(s.caption),
-                    ...(s.expected !== undefined ? { expected: redactRoute(s.expected) } : {}),
-                    ...(s.reason !== undefined ? { reason: redactRoute(s.reason) } : {}),
-                    ...(s.path !== undefined ? { path: redactRoute(s.path) } : {}),
+                    caption: redactText(s.caption),
+                    ...(s.expected !== undefined ? { expected: redactText(s.expected) } : {}),
+                    ...(s.reason !== undefined ? { reason: redactText(s.reason) } : {}),
+                    ...(s.path !== undefined ? { path: redactText(s.path) } : {}),
                 })),
             })),
         })),
@@ -314,7 +388,7 @@ export function buildCheckReplayHtml(replay, meta) {
   <dl>${pair("App", meta.origin)}${pair("Started", stamp(meta.startedAt))}${pair("Ended", stamp(meta.endedAt))}${meta.commit ? pair("Commit", meta.commit) : ""}${pair("SceneScout", `v${meta.version}`)}${pair("Frames", String(frames))}${replayVideos(replay).length > 0 ? pair("Videos", String(replayVideos(replay).length)) : ""}</dl>
 </header>
 <main>
-<p class="note">Each role, then each journey it walked, step by step, with the page as it was after the step${frames === 0 ? " when the check was recorded (--record)" : ""}. Typed values are never shown, and secrets in addresses are redacted as in the report.${replay.framesLeftOut > 0
+<p class="note">Each role, then each journey it walked, step by step, with the page as it was after the step${frames === 0 ? " when the check was recorded (--record)" : ""}. Typed values are never shown, and secrets in addresses are redacted as in the report, as are email addresses and card numbers.${replay.framesLeftOut > 0
         ? ` ${replay.framesLeftOut} step(s) and visit(s) have no frame because their session had already kept ${replay.frameCap ?? RECORD_MAX_FRAMES}, the most one session keeps.`
         : ""}</p>
 ${replay.roles.map((r, i) => roleHtml(r, i, replay.frameCap ?? RECORD_MAX_FRAMES)).join("\n") || '<p class="none">Nothing was recorded.</p>'}

package/dist/engine/check-report.js

@@ -27,15 +27,15 @@ import { escapeHtml } from "./replay.js";
 /** The page's generator mark: an earlier run's report is removed or replaced only when it carries it. */
 export const REPORT_GENERATOR = "scenescout-check-report";
 /** The file the report is written to when the template names none. */
-export const DEFAULT_REPORT_FILE = "report.html";
+const DEFAULT_REPORT_FILE = "report.html";
 /** What the cell of a missing value shows. */
 export const MISSING = "—";
 /** A report's file name: plain, in the output folder itself, ending .html. */
-export const REPORT_FILE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.html$/;
+const REPORT_FILE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.html$/;
 /** A name Windows reserves for a device whatever its extension (CON.html opens the console): never a report's file. */
-export const WINDOWS_DEVICE_RE = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])\./i;
+const WINDOWS_DEVICE_RE = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])\./i;
 /** Whether a name may be a report's file: plain, ending .html, not replay.html and not a Windows device name. */
-export function isReportFileName(name) {
+function isReportFileName(name) {
     return REPORT_FILE_RE.test(name) && !WINDOWS_DEVICE_RE.test(name) && name.toLowerCase() !== REPLAY_FILE;
 }
 /**
@@ -55,11 +55,11 @@ export function isGeneratedReport(html) {
 }
 // ── the template ────────────────────────────────────────────────────────────
 /** The columns a test table may have, in any order. */
-export const REPORT_COLUMNS = ["testId", "requirements", "step", "expected", "actual", "result", "evidence"];
+const REPORT_COLUMNS = ["testId", "requirements", "step", "expected", "actual", "result", "evidence"];
 /** The sections a template may order. Each data section appears at most once; `text` as often as wanted. */
-export const REPORT_SECTIONS = ["summary", "tests", "deviations", "manifest", "signoff", "text"];
+const REPORT_SECTIONS = ["summary", "tests", "deviations", "manifest", "signoff", "text"];
 /** The tokens the title block may use, each replaced by a fact of the run. */
-export const REPORT_TOKENS = {
+const REPORT_TOKENS = {
     date: "the day the run started, YYYY-MM-DD (UTC)",
     time: "the time the run started, HH:MM:SS (UTC)",
     run: "the run's start as YYYYMMDD-HHMMSS (UTC)",
@@ -67,7 +67,7 @@ export const REPORT_TOKENS = {
     commit: "the commit the run was of (GITHUB_SHA), shortened to 12 characters, or — when none",
 };
 /** Every word the page writes that is not data. A template may replace any of them, so it carries its own vocabulary. */
-export const DEFAULT_LABELS = {
+const DEFAULT_LABELS = {
     pass: "Pass",
     fail: "Fail",
     refused: "Could not run",