Stop flagging autofill-suppressed and look-alike fields as sensitive

CHANGELOG.md

@@ -1,6 +1,7 @@
 # Changelog
 
 ## Unreleased
+- Ordinary form fields no longer require a human handoff. AgentTab refused to fill every text input on forms such as the Azure portal's, because those sites set `autocomplete="new-password"` on plain text inputs to stop browser autofill, and it also flagged labels that merely contained a short secret word, such as "residual" or "incident" (both contain "cid"). `autocomplete="new-password"` alone no longer marks a field sensitive, and the short terms `cid`, `2fa`, and `totp` now match whole words only. Password inputs, `current-password`, `one-time-code`, `webauthn`, and `cc-*` autocomplete tokens, and fields named for passwords, one-time codes, captchas, card data, or bank numbers, including joined names such as `password2` or `captchacode`, still require a handoff.
 - Windows host builds are now reproducible. The MSVC linker wrote the link time into each executable, so two builds of the same source differed and the release workflow's determinism check failed for `x86_64-pc-windows-msvc`. A root `.cargo/config.toml` now links Windows MSVC targets with `/Brepro`, which derives the timestamp and debug identifier from the binary's contents.
 - The host now closes a task after 24 hours with no connection, owned tab, or staged Commit. Previously a task stayed open until an agent finished or closed it explicitly, so every session that disconnected without finishing left an open task in `state.sqlite3` indefinitely. Tasks that own tabs are never closed this way, and a task that was connected when the host stopped counts its idle time from the restart.
 - A connection acknowledgement that does not resume a supplied capability now carries `resume_rejection`: `task_closed` when the task was finished or closed, or `unknown_capability` otherwise. The host keeps closed tasks' capability hashes for a year to tell the two apart. On `task_closed`, the TypeScript and Python SDKs, and through them the MCP, OMP, Pi, and GPT-Control adapters, clear the stored capability and connect as a new task instead of failing with "rejected the stored resume capability" until the state was deleted by hand. Any other rejection still refuses to connect and keeps the stored capability.

packages/extension/src/sensitive-field.ts

@@ -41,24 +41,31 @@ export function sensitiveFieldState(this: Element): SensitiveFieldState {
   ].filter(Boolean).join(" ");
   const descriptor = rawDescriptor.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
   const compactDescriptor = descriptor.replace(/\s+/g, "");
+  // Bare tokens without trailing digits, so "cid2" still reads as "cid".
+  const tokens = descriptor.split(" ").map((token) => token.replace(/\d+$/, ""));
   const tag = String(this.tagName || "").toUpperCase();
   const editable = tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || control.isContentEditable === true ||
     role === "textbox" || role === "combobox" || role === "spinbutton";
+  // Long terms are unambiguous, so they match inside joined names ("password2", "captchacode"). Short terms
+  // occur inside ordinary words ("residual" contains "cid"), so they must be a whole token.
   const namedSecret =
     /\b(password|otp|totp|mfa(?: code|token)?|2fa(?: code)?|(?:two|multi) factor (?:authentication )?(?:code|token)|one time (?:code|password)|verification code|authentication code|auth code|(?:re ?|h ?)?captcha|(?:cvv|cvc|cvn)\d*|cid|security code|card security code|card verification (?:value|code|number)|card number|credit card number|cc number|card (?:expiration|expiry) (?:date|month|year)|bank account number|routing number|iban)\b/
       .test(descriptor) ||
     [
-      "password", "onetimecode", "onetimepassword", "verificationcode", "authenticationcode", "authcode", "totp",
-      "2fa", "2facode", "twofactorcode", "twofactortoken", "twofactorauthenticationcode", "multifactorcode",
-      "multifactortoken", "multifactorauthenticationcode", "captcha", "cid", "securitycode",
+      "password", "onetimecode", "onetimepassword", "verificationcode", "authenticationcode", "authcode",
+      "2facode", "twofactorcode", "twofactortoken", "twofactorauthenticationcode", "multifactorcode",
+      "multifactortoken", "multifactorauthenticationcode", "captcha", "securitycode",
       "cardverificationvalue", "cardverificationcode", "cardverificationnumber", "cardnumber", "creditcardnumber",
       "ccnumber", "cardsecuritycode", "cardexpirationdate", "cardexpirationmonth", "cardexpirationyear",
       "cardexpirydate", "cardexpirymonth", "cardexpiryyear", "bankaccountnumber", "routingnumber",
-    ].some((term) => compactDescriptor.includes(term));
+    ].some((term) => compactDescriptor.includes(term)) ||
+    ["cid", "2fa", "totp"].some((term) => tokens.includes(term));
   const tokenSecret = /\b(pin|passcode)\b/.test(descriptor);
+  // `autocomplete="new-password"` is not a signal on its own: sites put it on ordinary text inputs to stop
+  // browser autofill. A real new-password field is still caught by `type="password"` or its name.
   const sensitiveField = type === "password" ||
     autocomplete.some((token) =>
-      token === "current-password" || token === "new-password" || token === "one-time-code" ||
+      token === "current-password" || token === "one-time-code" ||
       token === "webauthn" || token.startsWith("cc-")) ||
     (editable && (namedSecret || tokenSecret));
   return { sensitiveField, associated, accessible };

packages/extension/test/extension.test.ts

@@ -20,6 +20,7 @@ import {
   type PageAgentRequest,
 } from "../src/page-agent-protocol";
 import { installPageAgent } from "../src/page-agent";
+import { sensitiveFieldState } from "../src/sensitive-field";
 
 const LEGACY_TASKS_KEY = "chromeBridgeTaskSessions";
 const LEGACY_PREFERENCES_KEY = "chromeBridgePreferences";
@@ -3478,6 +3479,37 @@ describe("page revision monotonicity", () => {
     expect((await readState()).stagedCommits).toEqual({});
   });
 
+  test("does not treat autofill-suppressed or merely similar fields as sensitive", () => {
+    const field = (attributes: Record<string, string>, label = "") => ({
+      tagName: "INPUT",
+      id: attributes.id ?? "",
+      labels: label ? [{ innerText: label }] : [],
+      ownerDocument: { getElementById() { return null; } },
+      getAttribute(name: string) { return attributes[name] ?? null; },
+    }) as unknown as Element;
+    const sensitive = (element: Element) => sensitiveFieldState.call(element).sensitiveField;
+
+    // Portals put autocomplete="new-password" on plain text inputs to stop browser autofill.
+    expect(sensitive(field({ type: "text", autocomplete: "new-password", id: "field-r5__control" }, "City"))).toBe(false);
+    // Secret words embedded in ordinary words are not secrets.
+    expect(sensitive(field({ type: "text", name: "residualValue" }, "Residual value"))).toBe(false);
+    expect(sensitive(field({ type: "text", name: "incidentId" }, "Incident"))).toBe(false);
+    expect(sensitive(field({ type: "text", name: "shipping" }, "Shipping"))).toBe(false);
+
+    // Hard signals, secret names, and secret names joined to other words or digits still require a handoff.
+    expect(sensitive(field({ type: "password", autocomplete: "new-password" }))).toBe(true);
+    expect(sensitive(field({ type: "text", autocomplete: "current-password" }))).toBe(true);
+    expect(sensitive(field({ type: "text", autocomplete: "new-password", name: "password" }))).toBe(true);
+    expect(sensitive(field({ type: "text", name: "cardnumber" }))).toBe(true);
+    expect(sensitive(field({ type: "text" }, "CID"))).toBe(true);
+    // A revealed password field: "show password" switches the type to text.
+    expect(sensitive(field({ type: "text", autocomplete: "new-password", name: "password2" }))).toBe(true);
+    expect(sensitive(field({ type: "text", id: "confirmpassword" }))).toBe(true);
+    expect(sensitive(field({ type: "text", name: "captchacode" }))).toBe(true);
+    expect(sensitive(field({ type: "text", name: "smsverificationcode" }))).toBe(true);
+    expect(sensitive(field({ type: "text", name: "cid2" }))).toBe(true);
+  });
+
   test("rechecks inferred sensitivity immediately before mutation", async () => {
     let assignments = 0;
     let dispatchedEvents = 0;