flowproof 0.23.0__tar.gz → 0.23.2__tar.gz

{flowproof-0.23.0 → flowproof-0.23.2}/Cargo.lock

@@ -930,7 +930,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -967,7 +967,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -992,7 +992,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "calamine",
  "flowproof-trace",
@@ -1008,7 +1008,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -1020,7 +1020,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -1034,7 +1034,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.23.0"
+version = "0.23.2"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.23.0 → flowproof-0.23.2}/Cargo.toml

@@ -22,7 +22,7 @@ members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproo
 exclude = ["spike/windows-containment"]
 
 [workspace.package]
-version = "0.23.0"
+version = "0.23.2"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.23.0 → flowproof-0.23.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.23.0
+Version: 0.23.2
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.23.0 → flowproof-0.23.2}/crates/flowproof-adapters/src/lib.rs

@@ -100,6 +100,9 @@ pub use web::WebAppDriver;
 #[cfg(feature = "web")]
 pub use web::shutdown_shared_browser;
 
+#[cfg(feature = "web")]
+pub use web::SharedBrowserGuard;
+
 #[derive(Debug, thiserror::Error)]
 pub enum AdapterError {
     #[error("adapter '{0}' is not implemented yet")]

{flowproof-0.23.0 → flowproof-0.23.2}/crates/flowproof-adapters/src/web.rs

@@ -22,6 +22,126 @@ use crate::AdapterError;
 
 const FIND_TIMEOUT: Duration = Duration::from_secs(5);
 
+/// WebGUI table controls use a separate draggable scrollbar. Native
+/// scrollIntoView scrolls their overflow:hidden body without updating the
+/// header or SAP's column position, so the next click edits the wrong cell.
+/// Move the rendered scrollbar instead; never call SAP application internals.
+fn scroll_element_into_view(element: &headless_chrome::Element<'_>) -> anyhow::Result<()> {
+    const PLAN: &str = r#"function() { return JSON.stringify((() => {
+        if (!document.querySelector('#webguiPage0, #webguiform0')) return {kind:'native'};
+        const pane=this.closest('[id$="-mrss-cont-none"]');
+        if (!pane) return {kind:'native'};
+        const prefix=pane.id.slice(0,-'-mrss-cont-none'.length);
+        const bar=document.getElementById(prefix+'_hscroll-bar');
+        const thumb=document.getElementById(prefix+'_hscroll-hdl');
+        const content=document.getElementById(pane.id+'-content');
+        if (!bar || !thumb || !content) return {kind:'native'};
+        pane.scrollIntoView({block:'nearest',inline:'nearest',behavior:'instant'});
+        const p=pane.getBoundingClientRect(),r=this.getBoundingClientRect();
+        if (r.left>=p.left-1 && r.right<=p.right+1) return {kind:'ready'};
+        const b=bar.getBoundingClientRect(),h=thumb.getBoundingClientRect();
+        const width=content.getBoundingClientRect().width;
+        if (b.width<=h.width || h.width<=0 || h.height<=0 || width<=p.width)
+            return {kind:'unavailable'};
+        const travel=b.width-h.width;
+        const delta=(r.left+r.width/2)-(p.left+p.width/2);
+        const current=h.left-b.left;
+        const next=Math.max(0,Math.min(travel,current+delta*travel/(width-p.width)));
+        if (Math.abs(next-current)<1) return {kind:'unavailable'};
+        return {kind:'drag',x:h.left+h.width/2,y:h.top+h.height/2,
+            toX:b.left+next+h.width/2};
+    })()); }"#;
+    for _ in 0..6 {
+        let result = element.call_js_fn(PLAN, vec![], false)?;
+        let raw = result
+            .value
+            .and_then(|v| v.as_str().map(str::to_owned))
+            .ok_or_else(|| anyhow::anyhow!("no grid scroll plan"))?;
+        let plan: serde_json::Value = serde_json::from_str(&raw)?;
+        match plan["kind"].as_str() {
+            Some("native") => {
+                element.scroll_into_view()?;
+                return Ok(());
+            }
+            Some("ready") => return Ok(()),
+            Some("drag") => {}
+            _ => anyhow::bail!("SAP grid's horizontal scrollbar cannot expose the target cell"),
+        }
+        let x = plan["x"]
+            .as_f64()
+            .ok_or_else(|| anyhow::anyhow!("no scrollbar x"))?;
+        let y = plan["y"]
+            .as_f64()
+            .ok_or_else(|| anyhow::anyhow!("no scrollbar y"))?;
+        let to_x = plan["toX"]
+            .as_f64()
+            .ok_or_else(|| anyhow::anyhow!("no scrollbar destination"))?;
+        let send = |kind, at_x, pressed| {
+            element.parent.call_method(Input::DispatchMouseEvent {
+                Type: kind,
+                x: at_x,
+                y,
+                button: Some(if pressed {
+                    Input::MouseButton::Left
+                } else {
+                    Input::MouseButton::None
+                }),
+                buttons: Some(if pressed { 1 } else { 0 }),
+                click_count: Some(1),
+                modifiers: None,
+                timestamp: None,
+                force: None,
+                tangential_pressure: None,
+                tilt_x: None,
+                tilt_y: None,
+                twist: None,
+                delta_x: None,
+                delta_y: None,
+                pointer_Type: None,
+            })
+        };
+        send(Input::DispatchMouseEventTypeOption::MouseMoved, x, false)?;
+        send(Input::DispatchMouseEventTypeOption::MousePressed, x, true)?;
+        for step in 1..=8 {
+            send(
+                Input::DispatchMouseEventTypeOption::MouseMoved,
+                x + (to_x - x) * f64::from(step) / 8.0,
+                true,
+            )?;
+        }
+        // MouseReleased still names the released button, but no button is held.
+        element.parent.call_method(Input::DispatchMouseEvent {
+            Type: Input::DispatchMouseEventTypeOption::MouseReleased,
+            x: to_x,
+            y,
+            button: Some(Input::MouseButton::Left),
+            buttons: Some(0),
+            click_count: Some(1),
+            modifiers: None,
+            timestamp: None,
+            force: None,
+            tangential_pressure: None,
+            tilt_x: None,
+            tilt_y: None,
+            twist: None,
+            delta_x: None,
+            delta_y: None,
+            pointer_Type: None,
+        })?;
+        std::thread::sleep(Duration::from_millis(50));
+    }
+    anyhow::bail!("SAP grid cell did not enter the viewport after scrolling")
+}
+
+/// Element::click performs its own native scroll, even after an actionability
+/// check. Keep all click paths (including the click before typing) on the same
+/// scrollbar-aware path as double-click and explicit scrolling.
+fn click_element(element: &headless_chrome::Element<'_>) -> anyhow::Result<()> {
+    scroll_element_into_view(element)?;
+    element.parent.click_point(element.get_midpoint()?)?;
+    Ok(())
+}
+
 /// Read a checkbox-like control's state from an element that may be the
 /// control itself OR a wrapper around it. Covers the three shapes real apps
 /// use: a native `input[type=checkbox|radio]`, an ARIA widget carrying
@@ -985,20 +1105,120 @@ pub fn shutdown_shared_browser() {
     }
 }
 
+/// Reference count of live `SharedBrowserGuard`s. `cargo test` runs `#[test]`
+/// functions concurrently by default, and the shared browser is one
+/// process-global static (see `shared_browser`) - a guard in test A that
+/// unconditionally killed it on drop would race test B, still mid-launch on
+/// the very same browser, and that race is not hypothetical: it reproduced
+/// live the first time this existed (network_idle_e2e's two tests, run
+/// together, one killing the shared browser out from under the other -
+/// "Unable to make method calls because underlying connection is closed").
+/// Only the LAST guard to drop may actually shut anything down.
+static GUARD_COUNT: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+/// Hold one of these (via [`SharedBrowserGuard::new`]) for the lifetime of
+/// anything that might launch the shared browser. The last one dropped
+/// calls `shutdown_shared_browser` for you - including on an early return
+/// or a panic, unlike a plain call at the end of a function body.
+/// `flowproof-cli::run_cli` holds one for the whole CLI process (where
+/// there is only ever one); any test that constructs a `WebAppDriver` on
+/// the shared path (the default - see `should_share_browser`) should hold
+/// one too, or it leaks a full Chrome process tree exactly like the CLI
+/// used to before this existed. Concurrent tests each holding their own
+/// guard are safe BECAUSE of the reference count above: the browser
+/// outlives every guard still alive, not just the one that happens to drop
+/// first.
+#[must_use = "holds the shared browser's cleanup for as long as this value lives - binding it to `_` is correct (that is what runs the guard for the rest of the scope); dropping it immediately with `drop(SharedBrowserGuard::new())` defeats the point"]
+pub struct SharedBrowserGuard(());
+
+impl SharedBrowserGuard {
+    pub fn new() -> Self {
+        GUARD_COUNT.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+        Self(())
+    }
+}
+
+impl Default for SharedBrowserGuard {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Drop for SharedBrowserGuard {
+    fn drop(&mut self) {
+        if GUARD_COUNT.fetch_sub(1, std::sync::atomic::Ordering::SeqCst) == 1 {
+            shutdown_shared_browser();
+        }
+    }
+}
+
+#[cfg(test)]
+mod shared_browser_guard_tests {
+    use super::{SharedBrowserGuard, GUARD_COUNT};
+    use std::sync::atomic::Ordering;
+
+    /// The race this reference count exists to prevent, reproduced live the
+    /// first time `SharedBrowserGuard` existed without it: two concurrent
+    /// `cargo test` threads share the one process-global browser
+    /// (`network_idle_e2e`'s two tests, run together - one guard's
+    /// unconditional drop killed the shared browser mid-launch on the
+    /// other, "Unable to make method calls because underlying connection is
+    /// closed"). A held sibling guard must keep the count above zero, so a
+    /// guard going out of scope while another is still alive must NOT be
+    /// the one that triggers a shutdown.
+    #[test]
+    fn a_held_sibling_guard_keeps_the_count_above_zero() {
+        let before = GUARD_COUNT.load(Ordering::SeqCst);
+        let first = SharedBrowserGuard::new();
+        assert_eq!(GUARD_COUNT.load(Ordering::SeqCst), before + 1);
+        {
+            let _second = SharedBrowserGuard::new();
+            assert_eq!(
+                GUARD_COUNT.load(Ordering::SeqCst),
+                before + 2,
+                "two live guards must both be counted"
+            );
+        }
+        // The second guard is gone, but `first` is still held - the count
+        // must reflect exactly that, not have raced to zero.
+        assert_eq!(
+            GUARD_COUNT.load(Ordering::SeqCst),
+            before + 1,
+            "one guard still alive must leave the count above zero"
+        );
+        drop(first);
+        assert_eq!(
+            GUARD_COUNT.load(Ordering::SeqCst),
+            before,
+            "the last guard dropping must return the count to its starting point"
+        );
+    }
+}
+
 /// Send an unconditional, immediate kill to a process by OS PID. Best
 /// effort: a PID that is already gone is not an error, and there is
 /// nothing useful to do with one that resists a kill signal/call.
 fn force_kill_pid(pid: u32) {
+    // Both this process's stdout/stderr are inherited by default, and the
+    // common case here is a PID that is already gone (the graceful CDP
+    // close above usually worked) - `kill`/`taskkill` printing "No such
+    // process" to OUR stderr on every routine success was real noise,
+    // observed leaking into flowproof's own error reports when this ran
+    // from inside a record/run invocation. Discard both explicitly.
     #[cfg(unix)]
     {
         let _ = std::process::Command::new("kill")
             .args(["-9", &pid.to_string()])
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
             .status();
     }
     #[cfg(windows)]
     {
         let _ = std::process::Command::new("taskkill")
             .args(["/F", "/PID", &pid.to_string()])
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
             .status();
     }
 }
@@ -1225,7 +1445,7 @@ impl WebAppDriver {
         let locator = Self::locator(selector)?;
         let got = self.with_element(&locator, &format!("locating [{selector}]"), |element| {
             if scroll {
-                element.scroll_into_view()?;
+                scroll_element_into_view(element)?;
             }
             let v = element.call_js_fn(
                 r#"function() {
@@ -1900,6 +2120,82 @@ fn is_transport_fault(message: &str) -> bool {
         || m.contains("unable to make method calls")
 }
 
+/// Retry a fallible operation exactly once if its first failure looks like
+/// a transient CDP transport fault - the same one-shot recovery
+/// `with_element` already gives element-scoped calls (re-finding the
+/// element and retrying its own op inline), generalized here for a call
+/// that talks to the tab directly and has nothing to re-resolve. Pure
+/// control flow, no CDP calls of its own, so it is unit-testable with a
+/// mock closure rather than only provable against a real, flaky browser.
+fn retry_once_on_transport_fault<T>(
+    mut attempt: impl FnMut() -> Result<T, String>,
+) -> Result<T, String> {
+    match attempt() {
+        Ok(value) => Ok(value),
+        Err(e) if is_transport_fault(&e) => {
+            std::thread::sleep(Duration::from_millis(300));
+            attempt()
+        }
+        Err(e) => Err(e),
+    }
+}
+
+#[cfg(test)]
+mod transport_retry_tests {
+    use super::retry_once_on_transport_fault;
+    use std::cell::Cell;
+
+    /// docs/fiori-reliability/FINDINGS.md:
+    /// medium-02-change-info-record-readonly.flow.yaml failed live with
+    /// "probing an iframe: Unable to make method calls because underlying
+    /// connection is closed" - `probe_frame`'s CDP call had no retry at all,
+    /// unlike every `with_element`-routed call, so a single transient CDP
+    /// hiccup killed the whole flow with zero chance to recover.
+    #[test]
+    fn a_transport_fault_recovers_on_the_second_attempt() {
+        let calls = Cell::new(0);
+        let result = retry_once_on_transport_fault(|| {
+            calls.set(calls.get() + 1);
+            if calls.get() == 1 {
+                Err("Unable to make method calls because underlying connection is closed".into())
+            } else {
+                Ok("recovered")
+            }
+        });
+        assert_eq!(result, Ok("recovered"));
+        assert_eq!(calls.get(), 2, "must retry exactly once, not loop");
+    }
+
+    #[test]
+    fn a_transport_fault_that_never_clears_still_fails_after_one_retry() {
+        let calls = Cell::new(0);
+        let result: Result<(), String> = retry_once_on_transport_fault(|| {
+            calls.set(calls.get() + 1);
+            Err("the event waited for never came".into())
+        });
+        assert_eq!(result, Err("the event waited for never came".to_string()));
+        assert_eq!(
+            calls.get(),
+            2,
+            "one retry, then give up - not an infinite loop"
+        );
+    }
+
+    /// A non-transport error (element genuinely missing, a real assertion
+    /// mismatch) must propagate immediately - this retry exists for a
+    /// flaky CONNECTION, not as a generic "try again" for any failure.
+    #[test]
+    fn a_non_transport_error_is_never_retried() {
+        let calls = Cell::new(0);
+        let result: Result<(), String> = retry_once_on_transport_fault(|| {
+            calls.set(calls.get() + 1);
+            Err("element not found".into())
+        });
+        assert_eq!(result, Err("element not found".to_string()));
+        assert_eq!(calls.get(), 1, "a non-transport error must not be retried");
+    }
+}
+
 /// How a [`UiaSelector`] resolves on a page: a CSS selector or a text
 /// anchor, optionally narrowed to the nth match (1-based).
 struct WebLocator {
@@ -2173,13 +2469,21 @@ impl WebAppDriver {
             op = serde_json::Value::from(op),
             arg = arg,
         );
-        let status = self
-            .tab()?
-            .evaluate(&call, false)
-            .map_err(|e| web_err("acting inside an iframe", e))?
-            .value
-            .and_then(|v| v.as_str().map(str::to_string))
-            .unwrap_or_default();
+        // Same gap `probe_frame` had (see docs/fiori-reliability/FINDINGS.md):
+        // this talks to the tab directly, with no element to re-resolve, so
+        // it never went through with_element's retry either - one transient
+        // CDP hiccup here (this is the exact call `type_text`'s framed path
+        // uses for every field inside an iframe) killed the whole flow.
+        let status = retry_once_on_transport_fault(|| {
+            self.tab()
+                .map_err(|e| e.to_string())?
+                .evaluate(&call, false)
+                .map_err(|e| e.to_string())
+        })
+        .map_err(|e| web_err("acting inside an iframe", e))?
+        .value
+        .and_then(|v| v.as_str().map(str::to_string))
+        .unwrap_or_default();
         let frame = &query.frame;
         match status.as_str() {
             "cross_origin" => Err(cross_origin(frame)),
@@ -2893,7 +3197,7 @@ impl AppDriver for WebAppDriver {
             // and clicking a zero-sized input does nothing - so the helper
             // hands back whichever ancestor is actually clickable.
             self.with_element(&locator, &format!("clicking [{selector}]"), |element| {
-                element.click().map(|_| ())
+                click_element(element)
             })?;
         }
         // Verify it took: a click that lands on a disabled or intercepted
@@ -3069,6 +3373,11 @@ impl AppDriver for WebAppDriver {
                 if (!el) {{ return 'missing'; }}
                 if (el.disabled === true || el.getAttribute('aria-disabled') === 'true'
                     || el.closest('fieldset[disabled]')) {{ return 'disabled'; }}
+                // The composed gate uses the custom scrollbar-aware scroll
+                // path. Native scrolling here would corrupt SAP's grid before
+                // replay even dispatches its click.
+                if (document.querySelector('#webguiPage0, #webguiform0')
+                    && el.closest('[id$=\"-mrss-cont-none\"]')) {{ return 'sap_grid'; }}
                 const a = el.getBoundingClientRect();
                 await new Promise(tick => setTimeout(tick, {interval}));
                 const b = el.getBoundingClientRect();
@@ -3093,6 +3402,7 @@ impl AppDriver for WebAppDriver {
             .map_err(|e| web_err(&format!("actionability of [{target}]"), e))?;
         let verdict = value.value.and_then(|v| v.as_str().map(str::to_string));
         Ok(match verdict.as_deref() {
+            Some("sap_grid") => return flowproof_driver::composed_actionability_gate(self, target),
             Some("ok") => None,
             Some("disabled") => Some("disabled".into()),
             Some("unstable") => Some("unstable (still moving/animating)".into()),
@@ -3285,11 +3595,34 @@ impl AppDriver for WebAppDriver {
                 match to {
                     // Bring an in-DOM element into the viewport.
                     ScrollTo::IntoView => {
+                        let sap = self
+                            .tab()?
+                            .evaluate(
+                                "!!document.querySelector('#webguiPage0, #webguiform0')",
+                                false,
+                            )
+                            .map_err(|e| web_err("checking the scroll surface", e))?
+                            .value
+                            .and_then(|v| v.as_bool())
+                            .unwrap_or(false);
+                        if sap {
+                            self.scene()?;
+                        }
+                        self.with_element(
+                            &locator,
+                            "scrolling the target",
+                            scroll_element_into_view,
+                        )?;
+                        // SAP may replace the table after scrolling/validation.
+                        // Settle that response and inspect a freshly resolved
+                        // element, not the detached pre-scroll handle.
+                        if sap {
+                            self.scene()?;
+                        }
                         let value = self.with_element(
                             &locator,
                             &format!("scrolling [{sel}] into view"),
                             |element| {
-                                element.scroll_into_view()?;
                                 element.call_js_fn(
                                     r#"function() {
                                         const r = this.getBoundingClientRect();
@@ -3442,7 +3775,7 @@ impl AppDriver for WebAppDriver {
                 // returns null - and the gate blocks a click that would have
                 // worked. A whole settings form under the fold was
                 // untestable this way (field report, round 3).
-                element.scroll_into_view()?;
+                scroll_element_into_view(element)?;
                 // Playwright's obscured check: does elementFromPoint at the
                 // element's center resolve to it (or a relative)? A toast or
                 // modal backdrop on top makes the click land elsewhere.
@@ -3571,7 +3904,7 @@ impl AppDriver for WebAppDriver {
         }
         let locator = Self::locator(selector)?;
         self.with_element(&locator, &format!("clicking [{selector}]"), |element| {
-            element.click().map(|_| ())
+            click_element(element)
         })
     }
 
@@ -3643,7 +3976,7 @@ impl AppDriver for WebAppDriver {
             &locator,
             &format!("right-clicking [{selector}]"),
             |element| {
-                element.scroll_into_view()?;
+                scroll_element_into_view(element)?;
                 let point = element.get_midpoint()?;
                 for kind in [
                     Input::DispatchMouseEventTypeOption::MousePressed,
@@ -3680,8 +4013,11 @@ impl AppDriver for WebAppDriver {
             &locator,
             &format!("double-clicking [{selector}]"),
             |element| {
-                element.scroll_into_view()?;
+                scroll_element_into_view(element)?;
                 let point = element.get_midpoint()?;
+                // Match a real pointer interaction (and ordinary click): grid
+                // editors may choose their active cell during pointer motion.
+                tab.move_mouse_to_point(point)?;
                 // A real `dblclick` is two full press/release pairs at the
                 // same point; Chromium raises the DOM `dblclick` on the
                 // SECOND release when its click_count reaches 2. Mirrors the
@@ -3725,7 +4061,7 @@ impl AppDriver for WebAppDriver {
         // even when the move landed on an occluder, so hover VERIFIES.
         let hovered =
             self.with_element(&locator, &format!("hovering [{selector}]"), |element| {
-                element.scroll_into_view()?;
+                scroll_element_into_view(element)?;
                 // NOT-OBSCURED gate: hovering an obscured element is
                 // meaningless because the occluder receives the `mouseover`,
                 // not our target. Same Playwright-style `elementFromPoint`
@@ -3829,13 +4165,23 @@ impl AppDriver for WebAppDriver {
             id = js(&query.inner_id),
             text = js(&query.inner_text),
         );
-        let status = self
-            .tab()?
-            .evaluate(&call, false)
-            .map_err(|e| web_err("probing an iframe", e))?
-            .value
-            .and_then(|v| v.as_str().map(str::to_string))
-            .unwrap_or_default();
+        // ONE retry on a transport fault, same recovery `with_element` gives
+        // element-scoped calls (see medium-02-change-info-record-readonly's
+        // real "probing an iframe: ... underlying connection is closed"
+        // failure in docs/fiori-reliability/FINDINGS.md): this call talks to
+        // the tab directly, with no element to re-resolve, so it never went
+        // through that retry at all - any transient CDP hiccup here killed
+        // the whole flow on the first blip, with zero chance to recover.
+        let status = retry_once_on_transport_fault(|| {
+            self.tab()
+                .map_err(|e| e.to_string())?
+                .evaluate(&call, false)
+                .map_err(|e| e.to_string())
+        })
+        .map_err(|e| web_err("probing an iframe", e))?
+        .value
+        .and_then(|v| v.as_str().map(str::to_string))
+        .unwrap_or_default();
         if status == "cross_origin" {
             return Ok(FrameProbe::CrossOrigin);
         }
@@ -3988,6 +4334,11 @@ impl AppDriver for WebAppDriver {
         // The two cases are now different answers: `not_select` is the
         // genuine fall-through to typing, `no_option` is a failure.
         const SELECT_COMMIT_JS: &str = r#"function(wanted) {
+            if ((this.tagName === 'INPUT' || this.tagName === 'TEXTAREA')
+                && this.id !== 'ToolbarOkCode'
+                && document.querySelector('#webguiPage0, #webguiform0')) {
+                return 'sap_input';
+            }
             if (this.tagName !== 'SELECT') { return 'not_select'; }
             const w = String(wanted).trim();
             const options = Array.from(this.options);
@@ -4035,6 +4386,12 @@ impl AppDriver for WebAppDriver {
                  value, then by visible text; nothing was selected"
             )));
         }
+        if status == "sap_input" {
+            // Focusing a WebGUI editor can replace it asynchronously. Finish
+            // that transition before selecting/typing, then resolve it again.
+            self.with_element(&locator, "focusing the SAP editor", click_element)?;
+            self.scene()?;
+        }
         self.with_element(&locator, &format!("typing into [{selector}]"), |element| {
             // Select what the field holds before the keystrokes land: typing
             // over a selection replaces, so the field ends up reading `text`
@@ -4050,7 +4407,11 @@ impl AppDriver for WebAppDriver {
             // `type_into`, which clicks again and would collapse the
             // selection back to a caret - the keystrokes would append, which
             // is the accident this contract removes.
-            element.click()?;
+            if status == "sap_input" {
+                element.call_js_fn("function() { this.focus(); }", vec![], false)?;
+            } else {
+                click_element(element)?;
+            }
             element
                 .call_js_fn(
                     r#"function() {
@@ -4061,7 +4422,24 @@ impl AppDriver for WebAppDriver {
                 )
                 .map(|_| ())?;
             element.parent.type_str(text).map(|_| ())
-        })
+        })?;
+        if status == "sap_input" {
+            // WebGUI commits fields on blur. The next click can otherwise
+            // race the response that replaces the form and erase its input.
+            // Match the framed SAP path, then reuse the existing network and
+            // scene settling rather than adding a fixed sleep to every field.
+            self.press_key("Tab", &[])?;
+            self.scene()?;
+            // Type leaves the edited field focused. Otherwise a following
+            // Enter could activate the next toolbar/section button instead
+            // of validating the form. Re-resolve after SAP replaces controls.
+            self.with_element(
+                &locator,
+                "restoring the edited SAP field's focus",
+                |element| element.call_js_fn("function() { this.focus(); }", vec![], false),
+            )?;
+        }
+        Ok(())
     }
 
     fn click_at(
@@ -4081,7 +4459,7 @@ impl AppDriver for WebAppDriver {
             &locator,
             &format!("locating the click point in [{selector}]"),
             |element| {
-                element.scroll_into_view()?;
+                scroll_element_into_view(element)?;
                 let got = element.call_js_fn(
                     r#"function(xp, yp) {
                         const r = this.getBoundingClientRect();