Treat joined totp and 2fa code names as sensitive

CHANGELOG.md

@@ -1,7 +1,7 @@
 # Changelog
 
 ## Unreleased
-- Ordinary form fields no longer require a human handoff. AgentTab refused to fill every text input on forms such as the Azure portal's, because those sites set `autocomplete="new-password"` on plain text inputs to stop browser autofill, and it also flagged labels that merely contained a short secret word, such as "residual" or "incident" (both contain "cid"). `autocomplete="new-password"` alone no longer marks a field sensitive, and the short terms `cid`, `2fa`, and `totp` now match whole words only. Password inputs, `current-password`, `one-time-code`, `webauthn`, and `cc-*` autocomplete tokens, and fields named for passwords, one-time codes, captchas, card data, or bank numbers, including joined names such as `password2` or `captchacode`, still require a handoff.
+- Ordinary form fields no longer require a human handoff. AgentTab refused to fill every text input on forms such as the Azure portal's, because those sites set `autocomplete="new-password"` on plain text inputs to stop browser autofill, and it also flagged labels that merely contained a short secret word, such as "residual" or "incident" (both contain "cid"). `autocomplete="new-password"` alone no longer marks a field sensitive, and the short terms `cid`, `2fa`, and `totp` now match whole words only. Password inputs, `current-password`, `one-time-code`, `webauthn`, and `cc-*` autocomplete tokens, and fields named for passwords, one-time codes, captchas, card data, or bank numbers, including joined names such as `password2`, `captchacode`, `totpcode`, or `2fatoken`, still require a handoff.
 - Windows host builds are now reproducible. The MSVC linker wrote the link time into each executable, so two builds of the same source differed and the release workflow's determinism check failed for `x86_64-pc-windows-msvc`. A root `.cargo/config.toml` now links Windows MSVC targets with `/Brepro`, which derives the timestamp and debug identifier from the binary's contents.
 - The host now closes a task after 24 hours with no connection, owned tab, or staged Commit. Previously a task stayed open until an agent finished or closed it explicitly, so every session that disconnected without finishing left an open task in `state.sqlite3` indefinitely. Tasks that own tabs are never closed this way, and a task that was connected when the host stopped counts its idle time from the restart.
 - A connection acknowledgement that does not resume a supplied capability now carries `resume_rejection`: `task_closed` when the task was finished or closed, or `unknown_capability` otherwise. The host keeps closed tasks' capability hashes for a year to tell the two apart. On `task_closed`, the TypeScript and Python SDKs, and through them the MCP, OMP, Pi, and GPT-Control adapters, clear the stored capability and connect as a new task instead of failing with "rejected the stored resume capability" until the state was deleted by hand. Any other rejection still refuses to connect and keeps the stored capability.

packages/extension/src/sensitive-field.ts

@@ -53,7 +53,8 @@ export function sensitiveFieldState(this: Element): SensitiveFieldState {
       .test(descriptor) ||
     [
       "password", "onetimecode", "onetimepassword", "verificationcode", "authenticationcode", "authcode",
-      "2facode", "twofactorcode", "twofactortoken", "twofactorauthenticationcode", "multifactorcode",
+      "totpcode", "totptoken", "2facode", "2fatoken", "twofactorcode", "twofactortoken", "twofactorauthenticationcode",
+      "multifactorcode",
       "multifactortoken", "multifactorauthenticationcode", "captcha", "securitycode",
       "cardverificationvalue", "cardverificationcode", "cardverificationnumber", "cardnumber", "creditcardnumber",
       "ccnumber", "cardsecuritycode", "cardexpirationdate", "cardexpirationmonth", "cardexpirationyear",

packages/extension/test/extension.test.ts

@@ -3508,6 +3508,8 @@ describe("page revision monotonicity", () => {
     expect(sensitive(field({ type: "text", name: "captchacode" }))).toBe(true);
     expect(sensitive(field({ type: "text", name: "smsverificationcode" }))).toBe(true);
     expect(sensitive(field({ type: "text", name: "cid2" }))).toBe(true);
+    expect(sensitive(field({ type: "text", name: "totpcode" }))).toBe(true);
+    expect(sensitive(field({ type: "text", name: "2fatoken" }))).toBe(true);
   });
 
   test("rechecks inferred sensitivity immediately before mutation", async () => {