Repository navigation
Conversation
A cross-site load gets a new renderer process, which numbers its nodes from the start again. The same form then gets the same element uids on a new document. Redaction tags are keyed by document, so the new fields are not redacted until a new fill. Add an e2e test for this case. Do not clear tags on navigation. Back can restore the old document from the back/forward cache with its filled values, and those must stay redacted. Refs EMG-293, #33. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Masked or script-controlled inputs can drop a value, and the result still said filled: true. Now the broker reads each field back over CDP after the write and compares it to the value in broker memory. The result gives, per field, the value length, whether it matches the secret when spaces and punctuation are ignored, and validity.valid. It also gives confirmed, which is true when every field matches. It never gives the value or any part of it. await_fill returns the same result. A field that holds fewer characters than were written no longer fails the fill. The result reports it instead. Add a fixture page that clears the card number on input and rejects the expiry format, and an e2e test for it. Refs EMG-294, #34. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent could not read a success message or an error, because the snapshot listed only interactive elements. Now the snapshot has a text field with the page's visible headings and its alert, status and live regions. It has at most 20 headings and 10 alerts, and each entry has at most 200 characters. Each entry goes through the value scan before it is cut, so a cut cannot leave part of a secret. innerText leaves out field values. The receipt fixture marks its confirmation as a status region. The formatted checkout fixture shows the card number in a status line, which the snapshot shows redacted. Refs EMG-295, #35. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The tool only returns not_implemented, but agents see it in tools/list and try it. Remove it from the registered tools and from the docs. The stub stays in the source. It comes back when it is implemented (#17). Refs EMG-303. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
figitaki
commented
Oct 23, 2026
figitaki
left a comment
figitaki
left a comment
Collaborator
Author
There was a problem hiding this comment.
Three issues reproduced against this head, with details inline.
The snapshot cut heading, alert and element text before the value scan. A secret longer than the cut lost its end, no longer matched, and its start reached the agent. Now the page returns the whole text, the broker scrubs it, and then cuts it. Text longer than 16384 characters is left out instead of cut. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The read-back treated a field as confirmed in two wrong cases: - The page removed the field. Its detached node kept the old value. A removed field now reports no length and matches: false. - The page changed a password, for example it removed punctuation. The comparison ignored all punctuation and applied NFKC to every secret. It is now exact. Only a number of digits, spaces and hyphens, in a field that is not a password input, may match with separators added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fill_secretorawait_fillwrites, the broker reads each field back. For each field the result gives the value length, whether it matches the secret, andvalidity.valid. The match is exact, except that a grouped card number (4242 4242 …) still matches; a password field never gets that tolerance. A field the page removed from the document is not confirmed. It also givesconfirmed. It never gives the value or any part of it. A field that drops the value no longer fails the fill; the result reports it. (EMG-294, fill_secret: confirm the field state after a fill #34)snapshothas a newtextfield with visible headings and alert, status and live regions. It is capped in count and length, and each entry is scrubbed whole before it is cut. Text longer than 16384 characters is left out. Elementtextin the snapshot is now also scrubbed before its 120-character cut. (EMG-295, snapshot: include visible page text so agents can read results and errors #35)list_network_requestsfromtools/listwhile it returns onlynot_implemented. It comes back when it is implemented (Implement list_network_requests with metadata only and body suppression #17). (EMG-303)Testing
bun test: 164 pass, 0 fail.bun run typecheckandbun run fmt:checkpass.length: 0, matches: false, a bad expiry format getsvalid: false, and a field the page removes getsmatches: false; the receipt page's confirmation text shows in the snapshot; a card number shown as status text is redacted.test/page-text.test.tsfor the text summary caps, and for scrubbing before the cut, including a secret longer than the cut and element text. Newtest/inject.test.tsfor the read-back comparison.🤖 Generated with Claude Code