scenescout 3.23.3 → 3.23.4

package/dist/engine/verify.js

@@ -26,7 +26,7 @@ import { normalizePath } from "./fingerprint.js";
 import { failingSignatures, isWorthALook } from "./memory.js";
 /** What a re-test found. */
 export const VERDICTS = ["gone", "present", "changed"];
-export const VERDICT_MEANING = {
+const VERDICT_MEANING = {
     gone: "re-tested and the evidence no longer reproduces — resolved",
     present: "re-tested and still reproduces exactly as filed",
     changed: "re-tested and something is different — still broken, but not as described",
@@ -172,7 +172,7 @@ const LOOK_ONLY = new Set([
     "record:full",
 ]);
 /** How the finding's page is reached again, or null when a check cannot re-test it deterministically. */
-export function loadRetest(item) {
+function loadRetest(item) {
     const signatures = [...failingSignatures(item.evidence)];
     // A POST that failed is not re-sent by loading a page, and a check would refuse to send it anyway.
     if (signatures.length === 0 || signatures.some((s) => !s.startsWith("GET ")))
@@ -196,7 +196,7 @@ export function loadRetest(item) {
         return null;
     return { item, path: `${url.pathname}${url.search}`, signatures };
 }
-export const RETEST_VERDICTS = ["reproduces", "possibly-fixed", "not-reached"];
+const RETEST_VERDICTS = ["reproduces", "possibly-fixed", "not-reached"];
 /**
  * Each re-testable finding against the page load that re-tests it.
  *

package/dist/export-run.js

@@ -20,7 +20,7 @@ import { resolveFrame } from "./engine/replay.js";
  * the request before it failed (a create that timed out or got a 5xx), so
  * whether the issue exists has to be asked again rather than assumed.
  */
-export class ExportError extends Error {
+class ExportError extends Error {
     uncertain;
     constructor(message, uncertain = false) {
         super(message);

package/dist/installer.js

@@ -11,7 +11,7 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { APPROX_DISK_MB, BROWSER_ENGINES, browserPresence, engineOf, playwrightInstallArgs, } from "./browsers.js";
-export const SKILL_NAME = "scenescout";
+const SKILL_NAME = "scenescout";
 export const MCP_NAME = "scenescout";
 /** Names this tool's skill and MCP server had before renames; cleaned up on install so the old slash command and a duplicate tool set do not linger. */
 const LEGACY_SKILL_NAMES = ["frontend-tester", "scenecraft"];
@@ -242,7 +242,7 @@ export function launchCommand(opts) {
     // resolves on PATH is better than an absolute path to nothing.
     return [fs.existsSync(npx) ? npx : "npx", ...NPX_SERVE_ARGS];
 }
-export function mcpAddArgs(launch) {
+function mcpAddArgs(launch) {
     return ["mcp", "add", "--scope", "user", MCP_NAME, "--", ...launch];
 }
 export function manualRegisterCommand(launch) {
@@ -340,7 +340,7 @@ function removeLegacyRegistrations(opts) {
  * symlink, and on a case-insensitive filesystem through a differently-cased
  * path. Comparing strings reported both as "pointing elsewhere".
  */
-export function samePath(a, b) {
+function samePath(a, b) {
     const real = (p) => {
         try {
             return fs.realpathSync.native(p);
@@ -568,7 +568,7 @@ export function installerFailure(stderr) {
         : null;
 }
 /** How long a browser download may run before it is stopped and reported as failed. */
-export const BROWSER_DOWNLOAD_TIMEOUT_MS = 15 * 60_000;
+const BROWSER_DOWNLOAD_TIMEOUT_MS = 15 * 60_000;
 /**
  * The environment Playwright's installer runs in. A host that runs this server
  * inside its own Electron binary (a desktop app's bundled runtime) makes

package/dist/login-run.js

@@ -104,7 +104,7 @@ const NOT_SAVED = {
     "timed-out": "The sign-in did not finish in time, so the window was closed and nothing was saved.",
 };
 /** Open the window a person signs in in. Throws a sentence when the browser cannot start or the page cannot load. */
-export async function openLoginWindow(options, opts = {}) {
+async function openLoginWindow(options, opts = {}) {
     const engine = options.browser ?? defaultEngine(process.env);
     const types = { chromium, firefox, webkit };
     // Checked before a window opens: a limit out of bounds is a sentence, not a browser left behind.
@@ -199,7 +199,7 @@ async function lookAt(win, watch) {
  * when), the window closes, or `signal` aborts. Resolves with how it ended;
  * the caller saves and closes.
  */
-export async function watchForSignIn(win, options, opts = {}) {
+async function watchForSignIn(win, options, opts = {}) {
     let closed = false;
     void win.closed.then(() => {
         closed = true;

package/dist/mcp-server.js

@@ -52,7 +52,7 @@ import { decodedEntitiesNote, ignoredConventionsNote, LANE_CONVENTION_MAX, LANE_
 import { MAX_UNFILED_NAMED, unfiledDefects } from "./engine/calibration.js";
 import { CallWork, SessionQueue, watchdogCap, withWatchdog } from "./engine/dispatch.js";
 import { FIXTURE_KINDS } from "./engine/fixtures.js";
-import { feedForSession, LIVE_ENV, writeStatusFile, LIVE_TOKEN_FILE, liveEngines, liveTokenFileName, pidAlive, statusFileName, LiveServer, StatusBoard, } from "./engine/live.js";
+import { feedForSession, LIVE_ENV, writeLiveToken, writeStatusFile, LIVE_TOKEN_FILE, liveEngines, liveTokenFileName, pidAlive, statusFileName, LiveServer, StatusBoard, } from "./engine/live.js";
 import { liveViewUrl, MCP_APP_MIME, paneData, paneText, STATUS_PANE_URI, STATUS_POLL_TOOL, STATUS_TOOL, } from "./engine/status-pane.js";
 import { statusPanePage } from "./engine/status-pane-page.js";
 import { formatBriefs, MAX_LANES, planLanes, replayBriefs } from "./engine/brief.js";
@@ -309,17 +309,13 @@ function publishLiveToken(dir) {
     // Named for this process: two engines on one project would otherwise hand
     // `watch` one token for two ports, and whichever wrote last would win.
     const file = path.join(dir, liveTokenFileName(process.pid));
-    const write = fs.promises
-        .writeFile(file, liveAddress.token, { mode: 0o600 })
-        // The shared name stays too, for a `watch` from before per-pid files.
-        .then(() => fs.promises.writeFile(path.join(dir, LIVE_TOKEN_FILE), liveAddress.token, { mode: 0o600 }))
-        // `mode` applies only when the file is created; a leftover one keeps its old bits.
-        .then(() => fs.promises.chmod(file, 0o600))
+    // The shared name is written too, for a `watch` from before per-pid files.
+    const write = writeLiveToken(dir, process.pid, liveAddress.token)
         .then(() => {
         liveDirs.add(dir);
     })
         .catch((err) => {
-        // A file with the wrong bits, or none: either way nothing to take back later.
+        // Whatever was written before the failure is taken back: nothing is left to remove at shutdown.
         void fs.promises.rm(file, { force: true }).catch(() => { });
         if (!liveTokenWarned)
             console.error(`[scenescout] could not write the live view's token file in ${dir}: ${err instanceof Error ? err.message : String(err)}`);
@@ -553,6 +549,7 @@ function serializedControl(fn) {
         // The SDK passes the request's extra (progress token, notifications) after the arguments; it is kept for the call, as requestExtra.
         const call = () => requestExtra.run(asRequestExtra(args[1]), () => fn(...args));
         const run = controlChain.then(call, call);
+        // The caller gets `run` and its error; the chain only needs to know the call has finished, so a failure must not block the next control call.
         controlChain = run.catch(() => { });
         return run;
     };
@@ -1565,7 +1562,7 @@ server.registerTool("scout_click", {
     }
 }));
 server.registerTool("scout_type", {
-    description: "Type into a text input/textarea/composer by ref, the way a real user does: if the field already holds content (e.g. an @-mention chip a menu click inserted), the text is APPENDED at the end — preserving that content — and the result reports what was already there (a separating space is added only at a word-to-word boundary). Pass replace=true to clear the field first (correcting a previous entry); an empty textValue always clears. Appending fires input events but not keydown, so keydown-driven triggers (slash/mention menus) will not react to appended text. Use for both valid values and boundary/fuzz values (empty, very long, unicode, script tags).",
+    description: "Type into a text input/textarea/composer by ref, the way a real user does: if the field already holds content (e.g. an @-mention chip a menu click inserted), the text is APPENDED at the end — preserving that content — and the result reports what was already there (a separating space is added only at a word-to-word boundary). Pass replace=true to clear the field first (correcting a previous entry); an empty textValue always clears. Appending fires input events but not keydown, so keydown-driven triggers (slash/mention menus) will not react to appended text. Use for both valid values and boundary/fuzz values (empty, very long, unicode, script tags). A value typed into a secret field (a password, a one-time code, a card number, a field labelled secret or token) is masked in the result and the log, as is what the field held.",
     inputSchema: {
         ref: z.string().describe("Element ref, e.g. e12"),
         textValue: z.string().optional().describe("Text to type"),

package/dist/playbook.js

@@ -23,7 +23,7 @@ export const SERVER_INSTRUCTIONS = `SceneScout explores a running web app in a r
     `If this client offers a SceneScout skill, load that. Otherwise call ${PLAYBOOK_TOOL} once, before the first scout_attach in a conversation, and follow what it returns. ` +
     `They are the same text, so never read both. ` +
     `Never choose mode="destructive" yourself: that needs the user's explicit opt-in.`;
-export const LEVELS = ["minimal", "medium", "extensive"];
+const LEVELS = ["minimal", "medium", "extensive"];
 /** What the `explore` prompt accepts, as MCP lists it. Every argument is optional. */
 export const EXPLORE_PROMPT_ARGUMENTS = [
     { name: "url", description: "URL of the running app, e.g. http://localhost:3000", required: false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.23.3",
+  "version": "3.23.4",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",
@@ -119,7 +119,7 @@
   "devDependencies": {
     "@changesets/cli": "3.0.3",
     "@types/node": "^20.19.0",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "tsx": "^4.23.15",
     "typescript": "^5.9.3",
     "yaml": "^2.9.1"