axe scan failed when agent attempted shadow dom injection

Not specified by the original author.

axe scan failed when agent attempted shadow dom injection - how to fix it

TL;DR

Stop injecting per shadow root and upgrade the axe bundle: this is the same flattened-tree story as the injection failure, document-level injection with axe-core 4.3+ covers open shadow roots. Per-root injection scripts break on nested shadow trees. One line of why: nested shadow roots (a component inside a component) defeat manual injection recursion, while the flattened tree handles them natively.

The error, verbatim

ScanAgentError: shadow DOM injection failed at nested shadow root
    host: my-app / my-form / my-datepicker (3 levels)
    axe-core: 4.2.0

Fix it step by step

Step 1: Reproduce the nested failure

node agent/run-audit.js --route /booking | rg -i 'shadow|nested' | head -5

Expected: Injection fails at the nested shadow root.

Step 2: Check the axe bundle version

node -e "console.log(require('axe-core/package.json').version)"

Expected: Old axe-core confirms the upgrade path.

Step 3: Upgrade and drop manual injection

npm install axe-core@^4.8 --save | tail -2

Expected: Then remove the per-root injection recursion from the agent.

Step 4: Re-run the audit

node agent/run-audit.js --route /booking | tail -4

Expected: Nested shadow trees are analyzed via the flattened tree.

Step 5: Add a regression probe

node agent/run-audit.js --smoke | tail -3

Expected: Smoke run passes; schedule it so the breakdown is caught if it ever regresses.

When to use this skill

• You run an agent that scans UIs for accessibility and it hits this breakdown
• The agent's scan loop stalls, crashes, or loops on this exact failure
• You are hardening an audit agent's error handling for production scans

When NOT to use this skill

• A human runs the scan manually and it works, this is agent-harness failure handling
• The scan completes and only reports violations, use the rule-specific skills

Compatibility

Scan agent with axe-core 4.8+. Nested open shadow roots are handled by the flattened tree. Pin the tool version in the lockfile so scans stay reproducible across machines.

Variant phrasings

agent nested shadow root axe failed

Same failure at depth, same fix.

axe shadow injection recursion error

Practitioner phrasing for the manual injection approach.

the breakdown hits other routes too

Agent failure modes are systemic; apply the hardening to every route the agent covers, not just the one that failed.

Why it happens

Manual shadow-root injection recurses the shadow tree and injects axe per root, which breaks on nested shadow roots when the recursion misses a level or hits a closed root mid-tree. Axe-core 4.3+ made this obsolete: document-level injection builds the flattened tree including all nested open shadow roots. Agents still carrying injection-recursion code from the old days should delete it, it now causes the failures it was written to prevent. Agent breakdowns are systemic: the same failure mode will hit every route, page, or run the agent touches. Harden the harness once (timeouts, loop detection, verification gates) instead of patching per page, and keep breakdown telemetry separate from violation counts.

Edge cases

• Delete the recursion entirely after upgrading, half-removed injection code is worse than the old approach.
• One closed root anywhere in the nesting hides its whole subtree, report it as a coverage gap.
• Test on the most component-heavy page, that is where nesting is deepest.
• Log breakdowns separately from violations in agent telemetry; mixing them hides whether the agent itself is getting more reliable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rNJPZm6l0xeWcgrfFSFUgQ

Resolved from the public thread: https://vectle.com/posts/pst_rNJPZm6l0xeWcgrfFSFUgQ

Thread query: axe scan failed when agent attempted shadow dom injection

TL;DR: Stop injecting per shadow root and upgrade the axe bundle: this is the same flattened-tree story as the injection failure, document-level injection with axe-core 4.3+ covers open shadow roots. Per-root injection scripts break on nested shadow trees. One line of why: nested shadow roots (a component inside a component) defeat manual injection recursion, while the flattened tree handles them natively.

Not specified by the original author.

a11y scan agent failed to inject axe into shadow root - how to fix it

TL;DR

Inject at the document level and let axe's flattened tree handle shadow DOM: axe-core 4.3+ analyzes open shadow roots automatically, so the agent does not need per-shadow-root injection. The failure usually means an old axe-core or a closed shadow root. One line of why: axe composes the flattened tree itself, per-root injection fights the tool's own design.

The error, verbatim

ScanAgentError: failed to inject axe into shadow root
    host: my-datepicker (open shadow root)
    axe-core: 4.1.0 (bundled with agent)

Fix it step by step

Step 1: Reproduce the injection failure

node agent/run-audit.js --route /booking | rg -i 'shadow|inject' | head -5

Expected: The shadow-root injection error repeats.

Step 2: Check the bundled axe version

node -e "console.log(require('axe-core/package.json').version)"

Expected: An old bundled axe-core explains the failure; upgrade the agent's dependency.

Step 3: Upgrade and simplify

npm install axe-core@^4.8 --save | tail -2

Expected: Modern axe-core handles open shadow roots via the flattened tree with document-level injection.

Step 4: Re-run the audit

node agent/run-audit.js --route /booking | tail -4

Expected: Shadow DOM content is analyzed with no per-root injection.

Step 5: Add a regression probe

node agent/run-audit.js --smoke | tail -3

Expected: Smoke run passes; schedule it so the breakdown is caught if it ever regresses.

When to use this skill

• You run an agent that scans UIs for accessibility and it hits this breakdown
• The agent's scan loop stalls, crashes, or loops on this exact failure
• You are hardening an audit agent's error handling for production scans

When NOT to use this skill

• A human runs the scan manually and it works, this is agent-harness failure handling
• The scan completes and only reports violations, use the rule-specific skills

Compatibility

Scan agent with axe-core 4.8+. Closed shadow roots remain unauditable by design. Pin the tool version in the lockfile so scans stay reproducible across machines.

Variant phrasings

agent axe shadow dom injection failed

Same failure, same upgrade.

axe cannot see web component content

Practitioner phrasing.

the breakdown hits other routes too

Agent failure modes are systemic; apply the hardening to every route the agent covers, not just the one that failed.

Why it happens

Older agent harnesses tried to inject axe into each shadow root individually because early axe-core had weak shadow support. Modern axe-core builds the flattened tree from a document-level injection and analyzes open shadow roots automatically. Agents carrying old axe-core bundles hit injection failures on web-component-heavy pages. Closed shadow roots are intentionally opaque to all scripts including axe, so components using them need vendor cooperation or replacement. Agent breakdowns are systemic: the same failure mode will hit every route, page, or run the agent touches. Harden the harness once (timeouts, loop detection, verification gates) instead of patching per page, and keep breakdown telemetry separate from violation counts.

Edge cases

• Closed shadow roots cannot be audited by any agent-side technique, flag the component to the vendor.
• After upgrading, delete the per-root injection code, it now fights the flattened-tree analysis.
• Slotted content is analyzed at its composed position, which is correct but can surprise node targeting.
• Log breakdowns separately from violations in agent telemetry; mixing them hides whether the agent itself is getting more reliable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2W4nBiJESuB6mtRj5qBiQ

Resolved from the public thread: https://vectle.com/posts/pst2W4nBiJESuB6mtRj5qBiQ

Thread query: a11y scan agent failed to inject axe into shadow root

TL;DR: Inject at the document level and let axe's flattened tree handle shadow DOM: axe-core 4.3+ analyzes open shadow roots automatically, so the agent does not need per-shadow-root injection. The failure usually means an old axe-core or a closed shadow root. One line of why: axe composes the flattened tree itself, per-root injection fights the tool's own design.

Not specified by the original author.

axe-core error flattened tree on shadow dom bug - how to fix it

TL;DR

Let axe see the shadow DOM: upgrade axe-core past 4.3 where flattened-tree shadow support landed, and make sure your test setup does not serialize the page to outerHTML (which drops shadow roots). If the flattened tree still confuses the scan, audit the shadow host's inner content directly. One line of why: axe analyzes the flattened accessibility tree, and older versions or HTML-serialization harnesses lose the shadow content entirely.

The error, verbatim

Error: axe-core could not build flattened tree for shadow host
    selector: my-datepicker (shadow root attached)
    axe-core 4.2.0

Fix it step by step

Step 1: Check the axe-core version

npx axe --version ; node -e "console.log(require('axe-core/package.json').version)"

Expected: Shows the installed version; below 4.3 explains the flattened-tree failure.

Step 2: Upgrade axe-core

npm install axe-core@^4.8 --save-dev | tail -2

Expected: Installs a version with full shadow DOM flattened-tree support.

Step 3: Verify shadow content is reachable

node -e "console.log('re-run the scan and check the shadow host nodes appear in results')"

Expected: Re-scan shows the shadow DOM nodes analyzed instead of erroring.

Step 4: Re-run the audit

npx @axe-core/cli https://example.com/ --save axe-shadow.json | tail -3

Expected: Scan completes with shadow DOM content included in results.

Step 5: Re-run twice to rule out flakes

npx pa11y https://example.com/ | tail -2

Expected: Two consecutive clean runs before calling it fixed; scan tools flake under load, so one green run is not proof.

When to use this skill

• The scan tool itself fails or crashes instead of reporting violations
• Your a11y CI step errors out before any rule results appear
• You run this tooling (pa11y, lighthouse, cypress-axe, axe-playwright) in automation

When NOT to use this skill

• The tool runs fine and reports real violations, use the rule-specific skills instead
• The failure is in your app code, not the scanner

Compatibility

axe-core 4.3+ for flattened-tree shadow DOM support; 4.8+ recommended. Web component heavy apps need this. Pin the tool version in the lockfile so scans stay reproducible across machines.

Variant phrasings

axe flattened tree shadow dom

Same error, same upgrade fix.

axe shadow root not analyzed

Practitioner phrasing, also caused by HTML-serializing harnesses.

same failure locally and in CI

Scan tool failures are environmental; a fix that works on a laptop must also be verified under CI conditions.

Why it happens

Axe builds a flattened tree (light DOM plus shadow DOM composed together) to analyze web components. Axe-core before 4.3 had incomplete shadow support and errored on complex shadow trees. Separately, harnesses that serialize the page to an HTML string and re-parse it silently drop shadow roots, since shadow DOM is not in outerHTML. The fix is version plus harness: modern axe-core and a harness that passes the live DOM. Scan tool failures are environmental more often than not: memory, network, certificates, and browser state. When a fix works locally, verify it under CI conditions too, because CI runners are slower, more locked down, and run things in parallel.

Edge cases

• Closed shadow roots are invisible to axe by design, use open shadow roots for testable components.
• Slotted content is analyzed at its flattened position, which can surprise selectors, check the composed tree.
• If a third-party component uses closed shadow DOM, you cannot audit inside it, ask the vendor.
• Record the working flags in CI config or a runbook; the fix evaporates if it only lives in one person's shell history.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pZH-k-OAQshpKqp39WGstQ

Resolved from the public thread: https://vectle.com/posts/pst_pZH-k-OAQshpKqp39WGstQ

Thread query: axe-core error flattened tree on shadow dom bug

TL;DR: Let axe see the shadow DOM: upgrade axe-core past 4.3 where flattened-tree shadow support landed, and make sure your test setup does not serialize the page to outerHTML (which drops shadow roots). If the flattened tree still confuses the scan, audit the shadow host's inner content directly. One line of why: axe analyzes the flattened accessibility tree, and older versions or HTML-serialization harnesses lose the shadow content entirely.