From 4fad7823fa46103044ebe823486b1bfa8de32b08 Mon Sep 17 00:00:00 2001 From: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com> Date: Tue, 27 Oct 2026 03:37:12 -0700 Subject: [PATCH 1/2] Stop flagging autofill-suppressed and look-alike fields as sensitive autocomplete=new-password alone no longer marks a field sensitive; sites use it on plain text inputs to suppress autofill. Secret names now match whole words only, so labels such as 'residual' no longer match 'cid'. --- CHANGELOG.md | 1 + packages/extension/src/sensitive-field.ts | 9 +++++--- packages/extension/test/extension.test.ts | 26 +++++++++++++++++++++++ 3 files changed, 33 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7d1cfbe..30c322d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # Changelog ## Unreleased +- Ordinary form fields no longer require a human handoff. AgentTab refused to fill every text input on forms such as the Azure portal's, because those sites set `autocomplete="new-password"` on plain text inputs to stop browser autofill, and it also flagged labels that merely contained a secret word, such as "residual" or "incident" (both contain "cid"). `autocomplete="new-password"` alone no longer marks a field sensitive, and secret names now match whole words only. Password inputs, `current-password`, `one-time-code`, `webauthn`, and `cc-*` autocomplete tokens, and fields named for passwords, one-time codes, card data, or bank numbers still require a handoff. - Windows host builds are now reproducible. The MSVC linker wrote the link time into each executable, so two builds of the same source differed and the release workflow's determinism check failed for `x86_64-pc-windows-msvc`. A root `.cargo/config.toml` now links Windows MSVC targets with `/Brepro`, which derives the timestamp and debug identifier from the binary's contents. - The host now closes a task after 24 hours with no connection, owned tab, or staged Commit. Previously a task stayed open until an agent finished or closed it explicitly, so every session that disconnected without finishing left an open task in `state.sqlite3` indefinitely. Tasks that own tabs are never closed this way, and a task that was connected when the host stopped counts its idle time from the restart. - A connection acknowledgement that does not resume a supplied capability now carries `resume_rejection`: `task_closed` when the task was finished or closed, or `unknown_capability` otherwise. The host keeps closed tasks' capability hashes for a year to tell the two apart. On `task_closed`, the TypeScript and Python SDKs, and through them the MCP, OMP, Pi, and GPT-Control adapters, clear the stored capability and connect as a new task instead of failing with "rejected the stored resume capability" until the state was deleted by hand. Any other rejection still refuses to connect and keeps the stored capability. diff --git a/packages/extension/src/sensitive-field.ts b/packages/extension/src/sensitive-field.ts index d6d8670..5fa23a8 100644 --- a/packages/extension/src/sensitive-field.ts +++ b/packages/extension/src/sensitive-field.ts @@ -40,10 +40,11 @@ export function sensitiveFieldState(this: Element): SensitiveFieldState { ...accessible, ].filter(Boolean).join(" "); const descriptor = rawDescriptor.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim(); - const compactDescriptor = descriptor.replace(/\s+/g, ""); + const tokens = descriptor.split(" "); const tag = String(this.tagName || "").toUpperCase(); const editable = tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || control.isContentEditable === true || role === "textbox" || role === "combobox" || role === "spinbutton"; + // Whole words only: a substring match flags ordinary labels ("residual" contains "cid"). const namedSecret = /\b(password|otp|totp|mfa(?: code|token)?|2fa(?: code)?|(?:two|multi) factor (?:authentication )?(?:code|token)|one time (?:code|password)|verification code|authentication code|auth code|(?:re ?|h ?)?captcha|(?:cvv|cvc|cvn)\d*|cid|security code|card security code|card verification (?:value|code|number)|card number|credit card number|cc number|card (?:expiration|expiry) (?:date|month|year)|bank account number|routing number|iban)\b/ .test(descriptor) || @@ -54,11 +55,13 @@ export function sensitiveFieldState(this: Element): SensitiveFieldState { "cardverificationvalue", "cardverificationcode", "cardverificationnumber", "cardnumber", "creditcardnumber", "ccnumber", "cardsecuritycode", "cardexpirationdate", "cardexpirationmonth", "cardexpirationyear", "cardexpirydate", "cardexpirymonth", "cardexpiryyear", "bankaccountnumber", "routingnumber", - ].some((term) => compactDescriptor.includes(term)); + ].some((term) => tokens.includes(term)); const tokenSecret = /\b(pin|passcode)\b/.test(descriptor); + // `autocomplete="new-password"` is not a signal on its own: sites put it on ordinary text inputs to stop + // browser autofill. A real new-password field is still caught by `type="password"` or its name. const sensitiveField = type === "password" || autocomplete.some((token) => - token === "current-password" || token === "new-password" || token === "one-time-code" || + token === "current-password" || token === "one-time-code" || token === "webauthn" || token.startsWith("cc-")) || (editable && (namedSecret || tokenSecret)); return { sensitiveField, associated, accessible }; diff --git a/packages/extension/test/extension.test.ts b/packages/extension/test/extension.test.ts index c2afcfd..25eb357 100644 --- a/packages/extension/test/extension.test.ts +++ b/packages/extension/test/extension.test.ts @@ -20,6 +20,7 @@ import { type PageAgentRequest, } from "../src/page-agent-protocol"; import { installPageAgent } from "../src/page-agent"; +import { sensitiveFieldState } from "../src/sensitive-field"; const LEGACY_TASKS_KEY = "chromeBridgeTaskSessions"; const LEGACY_PREFERENCES_KEY = "chromeBridgePreferences"; @@ -3478,6 +3479,31 @@ describe("page revision monotonicity", () => { expect((await readState()).stagedCommits).toEqual({}); }); + test("does not treat autofill-suppressed or merely similar fields as sensitive", () => { + const field = (attributes: Record, label = "") => ({ + tagName: "INPUT", + id: attributes.id ?? "", + labels: label ? [{ innerText: label }] : [], + ownerDocument: { getElementById() { return null; } }, + getAttribute(name: string) { return attributes[name] ?? null; }, + }) as unknown as Element; + const sensitive = (element: Element) => sensitiveFieldState.call(element).sensitiveField; + + // Portals put autocomplete="new-password" on plain text inputs to stop browser autofill. + expect(sensitive(field({ type: "text", autocomplete: "new-password", id: "field-r5__control" }, "City"))).toBe(false); + // Secret words embedded in ordinary words are not secrets. + expect(sensitive(field({ type: "text", name: "residualValue" }, "Residual value"))).toBe(false); + expect(sensitive(field({ type: "text", name: "incidentId" }, "Incident"))).toBe(false); + expect(sensitive(field({ type: "text", name: "shipping" }, "Shipping"))).toBe(false); + + // Hard signals and whole-word names still require a handoff. + expect(sensitive(field({ type: "password", autocomplete: "new-password" }))).toBe(true); + expect(sensitive(field({ type: "text", autocomplete: "current-password" }))).toBe(true); + expect(sensitive(field({ type: "text", autocomplete: "new-password", name: "password" }))).toBe(true); + expect(sensitive(field({ type: "text", name: "cardnumber" }))).toBe(true); + expect(sensitive(field({ type: "text" }, "CID"))).toBe(true); + }); + test("rechecks inferred sensitivity immediately before mutation", async () => { let assignments = 0; let dispatchedEvents = 0; From e0d1fb52f78e68c1679ced0c1061a28da3f2eebd Mon Sep 17 00:00:00 2001 From: Wolfgang Schoenberger <221313372+wolfiesch@users.noreply.github.com> Date: Tue, 27 Oct 2026 03:42:40 -0700 Subject: [PATCH 2/2] Keep matching secret names joined to other words or digits --- CHANGELOG.md | 2 +- packages/extension/src/sensitive-field.ts | 16 ++++++++++------ packages/extension/test/extension.test.ts | 8 +++++++- 3 files changed, 18 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 30c322d..7597cd6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,7 @@ # Changelog ## Unreleased -- Ordinary form fields no longer require a human handoff. AgentTab refused to fill every text input on forms such as the Azure portal's, because those sites set `autocomplete="new-password"` on plain text inputs to stop browser autofill, and it also flagged labels that merely contained a secret word, such as "residual" or "incident" (both contain "cid"). `autocomplete="new-password"` alone no longer marks a field sensitive, and secret names now match whole words only. Password inputs, `current-password`, `one-time-code`, `webauthn`, and `cc-*` autocomplete tokens, and fields named for passwords, one-time codes, card data, or bank numbers still require a handoff. +- Ordinary form fields no longer require a human handoff. AgentTab refused to fill every text input on forms such as the Azure portal's, because those sites set `autocomplete="new-password"` on plain text inputs to stop browser autofill, and it also flagged labels that merely contained a short secret word, such as "residual" or "incident" (both contain "cid"). `autocomplete="new-password"` alone no longer marks a field sensitive, and the short terms `cid`, `2fa`, and `totp` now match whole words only. Password inputs, `current-password`, `one-time-code`, `webauthn`, and `cc-*` autocomplete tokens, and fields named for passwords, one-time codes, captchas, card data, or bank numbers, including joined names such as `password2` or `captchacode`, still require a handoff. - Windows host builds are now reproducible. The MSVC linker wrote the link time into each executable, so two builds of the same source differed and the release workflow's determinism check failed for `x86_64-pc-windows-msvc`. A root `.cargo/config.toml` now links Windows MSVC targets with `/Brepro`, which derives the timestamp and debug identifier from the binary's contents. - The host now closes a task after 24 hours with no connection, owned tab, or staged Commit. Previously a task stayed open until an agent finished or closed it explicitly, so every session that disconnected without finishing left an open task in `state.sqlite3` indefinitely. Tasks that own tabs are never closed this way, and a task that was connected when the host stopped counts its idle time from the restart. - A connection acknowledgement that does not resume a supplied capability now carries `resume_rejection`: `task_closed` when the task was finished or closed, or `unknown_capability` otherwise. The host keeps closed tasks' capability hashes for a year to tell the two apart. On `task_closed`, the TypeScript and Python SDKs, and through them the MCP, OMP, Pi, and GPT-Control adapters, clear the stored capability and connect as a new task instead of failing with "rejected the stored resume capability" until the state was deleted by hand. Any other rejection still refuses to connect and keeps the stored capability. diff --git a/packages/extension/src/sensitive-field.ts b/packages/extension/src/sensitive-field.ts index 5fa23a8..8712268 100644 --- a/packages/extension/src/sensitive-field.ts +++ b/packages/extension/src/sensitive-field.ts @@ -40,22 +40,26 @@ export function sensitiveFieldState(this: Element): SensitiveFieldState { ...accessible, ].filter(Boolean).join(" "); const descriptor = rawDescriptor.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim(); - const tokens = descriptor.split(" "); + const compactDescriptor = descriptor.replace(/\s+/g, ""); + // Bare tokens without trailing digits, so "cid2" still reads as "cid". + const tokens = descriptor.split(" ").map((token) => token.replace(/\d+$/, "")); const tag = String(this.tagName || "").toUpperCase(); const editable = tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || control.isContentEditable === true || role === "textbox" || role === "combobox" || role === "spinbutton"; - // Whole words only: a substring match flags ordinary labels ("residual" contains "cid"). + // Long terms are unambiguous, so they match inside joined names ("password2", "captchacode"). Short terms + // occur inside ordinary words ("residual" contains "cid"), so they must be a whole token. const namedSecret = /\b(password|otp|totp|mfa(?: code|token)?|2fa(?: code)?|(?:two|multi) factor (?:authentication )?(?:code|token)|one time (?:code|password)|verification code|authentication code|auth code|(?:re ?|h ?)?captcha|(?:cvv|cvc|cvn)\d*|cid|security code|card security code|card verification (?:value|code|number)|card number|credit card number|cc number|card (?:expiration|expiry) (?:date|month|year)|bank account number|routing number|iban)\b/ .test(descriptor) || [ - "password", "onetimecode", "onetimepassword", "verificationcode", "authenticationcode", "authcode", "totp", - "2fa", "2facode", "twofactorcode", "twofactortoken", "twofactorauthenticationcode", "multifactorcode", - "multifactortoken", "multifactorauthenticationcode", "captcha", "cid", "securitycode", + "password", "onetimecode", "onetimepassword", "verificationcode", "authenticationcode", "authcode", + "2facode", "twofactorcode", "twofactortoken", "twofactorauthenticationcode", "multifactorcode", + "multifactortoken", "multifactorauthenticationcode", "captcha", "securitycode", "cardverificationvalue", "cardverificationcode", "cardverificationnumber", "cardnumber", "creditcardnumber", "ccnumber", "cardsecuritycode", "cardexpirationdate", "cardexpirationmonth", "cardexpirationyear", "cardexpirydate", "cardexpirymonth", "cardexpiryyear", "bankaccountnumber", "routingnumber", - ].some((term) => tokens.includes(term)); + ].some((term) => compactDescriptor.includes(term)) || + ["cid", "2fa", "totp"].some((term) => tokens.includes(term)); const tokenSecret = /\b(pin|passcode)\b/.test(descriptor); // `autocomplete="new-password"` is not a signal on its own: sites put it on ordinary text inputs to stop // browser autofill. A real new-password field is still caught by `type="password"` or its name. diff --git a/packages/extension/test/extension.test.ts b/packages/extension/test/extension.test.ts index 25eb357..6b8ba2a 100644 --- a/packages/extension/test/extension.test.ts +++ b/packages/extension/test/extension.test.ts @@ -3496,12 +3496,18 @@ describe("page revision monotonicity", () => { expect(sensitive(field({ type: "text", name: "incidentId" }, "Incident"))).toBe(false); expect(sensitive(field({ type: "text", name: "shipping" }, "Shipping"))).toBe(false); - // Hard signals and whole-word names still require a handoff. + // Hard signals, secret names, and secret names joined to other words or digits still require a handoff. expect(sensitive(field({ type: "password", autocomplete: "new-password" }))).toBe(true); expect(sensitive(field({ type: "text", autocomplete: "current-password" }))).toBe(true); expect(sensitive(field({ type: "text", autocomplete: "new-password", name: "password" }))).toBe(true); expect(sensitive(field({ type: "text", name: "cardnumber" }))).toBe(true); expect(sensitive(field({ type: "text" }, "CID"))).toBe(true); + // A revealed password field: "show password" switches the type to text. + expect(sensitive(field({ type: "text", autocomplete: "new-password", name: "password2" }))).toBe(true); + expect(sensitive(field({ type: "text", id: "confirmpassword" }))).toBe(true); + expect(sensitive(field({ type: "text", name: "captchacode" }))).toBe(true); + expect(sensitive(field({ type: "text", name: "smsverificationcode" }))).toBe(true); + expect(sensitive(field({ type: "text", name: "cid2" }))).toBe(true); }); test("rechecks inferred sensitivity immediately before mutation", async () => {