@addai/node 0.27.1 → 0.28.0

package/dist/desktop/install-engine.js

@@ -1,6 +1,42 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REPAIR_NEEDS_RESTART = void 0;
+exports.findBrew = findBrew;
+exports.macDmgScript = macDmgScript;
+exports.installingUser = installingUser;
 exports.installPlan = installPlan;
 exports.repairPlan = repairPlan;
 exports.runningAsRoot = runningAsRoot;
@@ -8,20 +44,101 @@ exports.sudoArgv = sudoArgv;
 exports.installEngine = installEngine;
 // Install a container engine on this machine, on request.
 //
-// Deliberately per-platform and deliberately honest about privilege: the
-// Linux path needs root, and a daemon running as an ordinary user cannot get
-// it. Rather than half-run and leave a broken apt state, it checks first and
-// says exactly what to do instead. A button that fails clearly beats one that
-// fails mysteriously.
+// Deliberately per-platform and deliberately honest about privilege: Linux and
+// a Homebrew-less Mac both need root, and a daemon running as an ordinary user
+// cannot get it. Rather than half-run and leave a broken install behind, it
+// checks first and either takes the password round trip or says exactly what
+// to do instead. A button that fails clearly beats one that fails mysteriously.
+//
+// What it must never do is refuse on behalf of a machine it hasn't looked at.
+// This shipped choosing `brew` by name, so a Mac without Homebrew — most Macs —
+// got "brew is not available here, install it by hand" from the button whose
+// entire job was doing the installing.
 const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const win_1 = require("../win");
-/** Pure, so the choice is testable on any machine. */
-function installPlan(platform, isRoot) {
+/**
+ * Where Homebrew actually lives.
+ *
+ * `brew` is not on the PATH of a daemon that did not come from a login shell —
+ * launchd hands a job `PATH=/usr/bin:/bin:/usr/sbin:/sbin`, and neither
+ * Homebrew prefix is in it. Spawning the bare name then fails ENOENT and the
+ * install reports "brew is not available here" on a machine that has brew,
+ * which is a lie the user cannot act on. Look where it really is instead.
+ */
+function findBrew(platform = process.platform) {
+    if (platform !== 'darwin')
+        return null;
+    return (0, win_1.findCliBinary)('brew', {
+        posixCandidates: [
+            '/opt/homebrew/bin/brew', // Apple Silicon
+            '/usr/local/bin/brew', // Intel
+            path.join(os.homedir(), 'homebrew', 'bin', 'brew'), // per-user prefix
+        ],
+    });
+}
+/**
+ * Install Docker Desktop from Docker's own disk image.
+ *
+ * The path for a Mac with no Homebrew — which is most Macs. This is the same
+ * download the `docker` cask fetches, driven by the installer Docker ships
+ * inside the app, so it is the vendor's supported unattended install rather
+ * than something we invented.
+ *
+ * Root is needed for one step: putting the app in /Applications and laying
+ * down its privileged helper. `--user` is what stops that cost being paid
+ * twice — without it, the first launch stops at an admin prompt on a machine
+ * nobody is sitting at.
+ */
+function macDmgScript(user) {
+    const u = user.replace(/[^A-Za-z0-9._-]/g, '');
+    const userFlag = u ? ` --user=${u}` : '';
+    // No progress bar on the download: every chunk of output is one database
+    // write on the command row, and a bar redrawing at 20Hz for 700MB would be
+    // thousands of them. A line per step is what the log is for.
+    return `set -e
+case "$(uname -m)" in arm64) slug=arm64 ;; *) slug=amd64 ;; esac
+tmp=$(mktemp -d)
+cleanup() { hdiutil detach -quiet "$tmp/mnt" 2>/dev/null || true; rm -rf "$tmp"; }
+trap cleanup EXIT
+echo "downloading Docker Desktop for $slug (about 700MB, this is the slow part)"
+curl -fsSL --retry 3 -o "$tmp/Docker.dmg" "https://desktop.docker.com/mac/main/$slug/Docker.dmg"
+echo "mounting the image"
+mkdir -p "$tmp/mnt"
+hdiutil attach -nobrowse -readonly -mountpoint "$tmp/mnt" "$tmp/Docker.dmg"
+echo "installing"
+"$tmp/mnt/Docker.app/Contents/MacOS/install" --accept-license${userFlag}
+echo "installed"`;
+}
+/** The current login name, for the `--user` the Docker installer wants. Never
+ *  root: under `sudo` that would hand the app to the wrong account. */
+function installingUser(env = process.env) {
+    return env.SUDO_USER || env.USER || env.LOGNAME || '';
+}
+/**
+ * Pure, so the choice is testable on any machine — the two impure lookups
+ * (is brew here, who are we) are parameters with defaults rather than calls
+ * inside the body.
+ */
+function installPlan(platform, isRoot, brew = findBrew(platform), user = installingUser()) {
     if (platform === 'darwin') {
-        // Homebrew installs Docker Desktop without sudo when brew owns its prefix.
+        // Homebrew installs Docker Desktop without sudo when brew owns its
+        // prefix, so it stays the first choice where it exists.
+        if (brew) {
+            return {
+                file: brew, args: ['install', '--cask', '--no-quarantine', 'docker'],
+                manual: 'brew install --cask docker', needsRoot: false,
+            };
+        }
+        // No Homebrew. This used to be the end of the road — the button said
+        // "install brew by hand" to someone who had asked us to do the installing.
+        // Docker's own image needs no package manager, only a password.
         return {
-            file: 'brew', args: ['install', '--cask', '--no-quarantine', 'docker'],
-            manual: 'brew install --cask docker', needsRoot: false,
+            file: isRoot ? 'sh' : null,
+            args: ['-c', macDmgScript(user)],
+            manual: 'download Docker Desktop from https://docker.com/products/docker-desktop and open it once',
+            needsRoot: true,
         };
     }
     if (platform === 'win32') {
@@ -71,6 +188,15 @@ async function installEngine(onLog, askPassword, alreadyInstalledButBlocked) {
     let args = plan.args;
     let password = null;
     // Docker present but the socket is refused: repair, do not reinstall.
+    //
+    // Only on Linux. `usermod -aG docker` is a Linux answer to a Linux problem;
+    // on a Mac or a Windows box "installed but not answering" means Docker
+    // Desktop is closed, and running usermod there would spend the user's
+    // password on a command that does not exist.
+    if (alreadyInstalledButBlocked && process.platform !== 'linux') {
+        throw new Error('Docker is already installed here — it is just not running. '
+            + 'Start it instead: press Start, or open Docker Desktop on that machine.');
+    }
     const repair = alreadyInstalledButBlocked
         ? repairPlan(process.env.USER || process.env.LOGNAME || 'root')
         : null;
@@ -104,7 +230,7 @@ async function installEngine(onLog, askPassword, alreadyInstalledButBlocked) {
         args = sudo.args;
     }
     if (!file) {
-        throw new Error(`This needs root, and the node is not running as root. Run this on ${require('os').hostname()}:\n  ${plan.manual}`);
+        throw new Error(`This needs root, and the node is not running as root. Run this on ${os.hostname()}:\n  ${plan.manual}`);
     }
     onLog(`installing a container engine\n  ${plan.manual}\n\n`);
     const inv = (0, win_1.resolveCliInvocation)(file, args);
@@ -124,7 +250,7 @@ async function installEngine(onLog, askPassword, alreadyInstalledButBlocked) {
         const cap = (b) => { const s = b.toString('utf8'); tail = (tail + s).slice(-2000); onLog(s); };
         child.stdout?.on('data', cap);
         child.stderr?.on('data', cap);
-        child.on('error', err => reject(new Error(`${file} is not available here. Install it by hand:\n  ${plan.manual}\n(${err.message})`)));
+        child.on('error', err => reject(new Error(`could not run ${file} on this machine. Install it by hand:\n  ${plan.manual}\n(${err.message})`)));
         child.on('exit', code => code === 0
             ? resolve()
             : reject(new Error(`${repair ? 'permission fix' : 'install'} failed (exit ${code}). Try by hand:\n  ${repair ? repair.manual : plan.manual}\n${tail.slice(-400)}`)));

package/dist/desktop/learn/browser.d.ts

@@ -0,0 +1,41 @@
+export declare const DEBUG_PORT = 9222;
+/** Where the browser really is, in the order we prefer to find it. Never
+ *  /usr/local/bin/browser itself: once that IS the wrapper, resolving through
+ *  it would point the wrapper at itself and exec forever. */
+export declare const REAL_BROWSERS: string[];
+export declare const WRAPPER_PATH = "/usr/local/bin/browser";
+/** The in-container script that signs the browser in. Beside the extension,
+ *  under the same bind mount, so it arrives by the same route. */
+export declare const SEED_SCRIPT = "/conf/vault/vault-seed.mjs";
+/**
+ * The wrapper, exactly.
+ *
+ * The address is pinned to loopback deliberately. The container publishes only
+ * VNC, but a debug port on 0.0.0.0 would still be reachable from the host, and
+ * CDP is complete control of the browser — cookies, storage, every page.
+ * Inside the container it crosses no boundary: the entity already has root
+ * there. Outside it, it would.
+ */
+export declare function wrapperScript(realBrowser: string, extensionDir?: string | null): string;
+/** Is what is on disk already what we would write? Exact match, so a change to
+ *  the script rewrites every desktop on its next start rather than leaving a
+ *  fleet on two versions. Rewriting is idempotent and costs one exec. */
+export declare function wrapperIsCurrent(content: string, realBrowser: string, extensionDir?: string | null): boolean;
+export type RunInDesktop = (cmd: string[]) => Promise<{
+    ok: boolean;
+    out: string;
+}>;
+export interface WrapperResult {
+    changed: boolean;
+    /** The real browser behind the wrapper, or null when the desktop has none. */
+    browser: string | null;
+    note?: string;
+}
+/**
+ * Put the wrapper in place if it is not already there.
+ *
+ * Safe to call on every desktop start and before every lesson: it reads what
+ * is there first and only writes when it differs, so the common case is two
+ * cheap execs and no change.
+ */
+export declare function ensureBrowserWrapper(run: RunInDesktop, confDir: string, extensionDir?: string | null): Promise<WrapperResult>;

package/dist/desktop/learn/browser.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEED_SCRIPT = exports.WRAPPER_PATH = exports.REAL_BROWSERS = exports.DEBUG_PORT = void 0;
+exports.wrapperScript = wrapperScript;
+exports.wrapperIsCurrent = wrapperIsCurrent;
+exports.ensureBrowserWrapper = ensureBrowserWrapper;
+// Making a desktop's browser watchable.
+//
+// CDP is how +Ai Learn knows WHICH control you clicked rather than only where
+// on the screen you clicked it. It needs Chrome to be listening on a debug
+// port, and that flag is read at process start — it cannot be added to a
+// browser that is already running.
+//
+// Every browser launch in a desktop goes through one path: /usr/local/bin/
+// browser, used by the dock launcher, by the MCP's open_url, and by anything
+// typed in the terminal. In the image it is a symlink to Chrome (amd64) or
+// Chromium (arm64). Replacing it with a three-line wrapper is therefore the
+// whole change — and it is a container-local runtime change, not a new image.
+//
+// Written through /conf rather than over stdin: the daemon already owns that
+// directory on the host and it appears inside the container, which is how
+// setup.sh gets there. One less thing to escape.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+exports.DEBUG_PORT = 9222;
+/** Where the browser really is, in the order we prefer to find it. Never
+ *  /usr/local/bin/browser itself: once that IS the wrapper, resolving through
+ *  it would point the wrapper at itself and exec forever. */
+exports.REAL_BROWSERS = [
+    '/usr/bin/google-chrome-stable',
+    '/usr/bin/chromium',
+    '/usr/bin/chromium-browser',
+];
+exports.WRAPPER_PATH = '/usr/local/bin/browser';
+/** The in-container script that signs the browser in. Beside the extension,
+ *  under the same bind mount, so it arrives by the same route. */
+exports.SEED_SCRIPT = '/conf/vault/vault-seed.mjs';
+/**
+ * The wrapper, exactly.
+ *
+ * The address is pinned to loopback deliberately. The container publishes only
+ * VNC, but a debug port on 0.0.0.0 would still be reachable from the host, and
+ * CDP is complete control of the browser — cookies, storage, every page.
+ * Inside the container it crosses no boundary: the entity already has root
+ * there. Outside it, it would.
+ */
+function wrapperScript(realBrowser, extensionDir) {
+    // Chrome 137 disabled --load-extension unless the switch that removed it is
+    // itself turned off. Both flags or neither: passing --load-extension alone
+    // is silently ignored, which looks exactly like a broken extension.
+    const ext = extensionDir
+        ? ` --load-extension=${extensionDir}` +
+            ' --disable-features=DisableLoadExtensionCommandLineSwitch'
+        : '';
+    // The seeder runs in the background and waits for the port, because the
+    // cookie can only be set once Chrome is listening — and Chrome only listens
+    // once it has started. Backgrounded and detached from the browser's fate:
+    // exec replaces this shell, so nothing here can hold the browser up.
+    const seed = extensionDir
+        ? `[ -f ${exports.SEED_SCRIPT} ] && (node ${exports.SEED_SCRIPT} >/dev/null 2>&1 &)\n`
+        : '';
+    return `#!/bin/sh
+# Written by @addai/node so +Ai Learn can watch this browser${extensionDir ? ' and the +Ai Vault can fill logins in it' : ''}.
+# Removing it costs you the page detail in a lesson${extensionDir ? ' and vault autofill' : ''} and nothing else.
+${seed}exec ${realBrowser} --remote-debugging-port=${exports.DEBUG_PORT} --remote-debugging-address=127.0.0.1${ext} "$@"
+`;
+}
+/** Is what is on disk already what we would write? Exact match, so a change to
+ *  the script rewrites every desktop on its next start rather than leaving a
+ *  fleet on two versions. Rewriting is idempotent and costs one exec. */
+function wrapperIsCurrent(content, realBrowser, extensionDir) {
+    return content === wrapperScript(realBrowser, extensionDir);
+}
+/**
+ * Put the wrapper in place if it is not already there.
+ *
+ * Safe to call on every desktop start and before every lesson: it reads what
+ * is there first and only writes when it differs, so the common case is two
+ * cheap execs and no change.
+ */
+async function ensureBrowserWrapper(run, confDir, extensionDir) {
+    const found = await run(['sh', '-c',
+        exports.REAL_BROWSERS.map(b => `[ -x ${b} ] && echo ${b}`).join(' || ') + ' || true']);
+    const real = found.out.trim().split('\n')[0]?.trim();
+    if (!real) {
+        return { changed: false, browser: null, note: 'this desktop has no browser installed' };
+    }
+    const current = await run(['sh', '-c', `cat ${exports.WRAPPER_PATH} 2>/dev/null || true`]);
+    if (wrapperIsCurrent(current.out, real, extensionDir))
+        return { changed: false, browser: real };
+    const dir = path.join(confDir, 'learn');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'browser'), wrapperScript(real, extensionDir), { mode: 0o755 });
+    // sudo, not `docker exec -u root`: the image gives the entity passwordless
+    // sudo inside its own container, and going through the same exec path as
+    // everything else keeps one way of talking to a desktop rather than two.
+    const put = await run(['sh', '-c',
+        `sudo cp /conf/learn/browser ${exports.WRAPPER_PATH} && sudo chmod +x ${exports.WRAPPER_PATH}`]);
+    if (!put.ok) {
+        return { changed: false, browser: real, note: `could not install the browser wrapper: ${put.out.trim().slice(0, 200)}` };
+    }
+    return { changed: true, browser: real };
+}

package/dist/desktop/learn/injected.mjs

@@ -0,0 +1,173 @@
+// The recorder that runs INSIDE every page of a desktop's browser.
+//
+// Injected through CDP (Page.addScriptToEvaluateOnNewDocument), so its source
+// is stringified and shipped as text. That has one hard consequence: nothing
+// here may reference module scope. The helpers are therefore passed into
+// pageRecorder as arguments and stitched together by injectedSource() below,
+// which keeps the functions the tests exercise and the functions the page runs
+// literally the same code.
+//
+// The rule this file exists to enforce: describe the CONTROL, never its VALUE.
+// The viewer already records what was typed, and that half gets redacted
+// server-side against the secret windows this file reports. If a value ever
+// leaked out of here it would bypass that entirely — it would be in the "safe"
+// track, the one stored raw.
+
+/** A control, as a person would point at it. No values, ever. */
+export function describeTarget(el) {
+  if (!el || !el.tagName) return { tag: 'unknown' };
+  const attr = (n) => {
+    try { return el.getAttribute ? el.getAttribute(n) : null; } catch { return null; }
+  };
+  const clean = (s) => {
+    const t = String(s == null ? '' : s).replace(/\s+/g, ' ').trim();
+    return t ? t.slice(0, 60) : null;
+  };
+  let labelText = null;
+  try {
+    if (el.labels && el.labels.length) labelText = clean(el.labels[0].innerText);
+  } catch { labelText = null; }
+
+  let css = null;
+  try {
+    const bits = [];
+    let node = el;
+    for (let depth = 0; node && node.tagName && depth < 4; depth++) {
+      let bit = node.tagName.toLowerCase();
+      if (node.id) { bits.unshift(bit + '#' + node.id); break; }
+      const cls = String(node.className || '').split(/\s+/).filter(Boolean).slice(0, 2);
+      if (cls.length) bit += '.' + cls.join('.');
+      bits.unshift(bit);
+      node = node.parentElement;
+    }
+    css = bits.join('>') || null;
+  } catch { css = null; }
+
+  return {
+    tag: el.tagName.toLowerCase(),
+    role: attr('role') || null,
+    // innerText, not value: a button says what it does, a field does not.
+    text: el.tagName.toLowerCase() === 'input' ? null : clean(el.innerText),
+    label: labelText || clean(attr('aria-label')),
+    name: clean(el.name) || clean(attr('name')),
+    id: clean(el.id) || null,
+    placeholder: clean(el.placeholder) || clean(attr('placeholder')),
+    css,
+  };
+}
+
+/**
+ * Is focus in something we must go blind for?
+ *
+ * Deliberately wider than input[type=password]: plenty of one-time-code and
+ * "access code" fields are plain text inputs, and a lesson that teaches a
+ * login will walk straight through one. Word-bounded so that "shipping" is not
+ * a PIN and "cardigan" is not a card number.
+ */
+export function isSecretField(el) {
+  if (!el || !el.tagName) return false;
+  const attr = (n) => {
+    try { return el.getAttribute ? el.getAttribute(n) : null; } catch { return null; }
+  };
+  const type = String(el.type || attr('type') || '').toLowerCase();
+  if (type === 'password') return true;
+
+  const auto = String(attr('autocomplete') || '').toLowerCase();
+  if (auto.includes('password') || auto.includes('one-time-code') || auto.includes('cc-number')) {
+    return true;
+  }
+
+  let labelText = '';
+  try {
+    if (el.labels && el.labels.length) labelText = String(el.labels[0].innerText || '');
+  } catch { labelText = ''; }
+
+  const hay = [el.name, attr('name'), el.id, el.placeholder, attr('placeholder'),
+    attr('aria-label'), labelText]
+    .map((v) => String(v == null ? '' : v))
+    .join(' ')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, ' ');
+
+  const SECRET = new RegExp('(^| )(password|passwd|pass|passcode|secret|token|otp|' +
+    'cvv|cvc|pin|card number|cardnumber|security code|access code|auth code)( |$)');
+  return SECRET.test(' ' + hay + ' ');
+}
+
+/**
+ * Watch one document. Returns nothing; reports through window.__addaiLearn,
+ * the CDP binding the recorder installs.
+ *
+ * Capture phase throughout, so a page that stops propagation on its own
+ * handlers (most single-page apps do) cannot make a lesson go blank.
+ */
+export function pageRecorder(describe, isSecret) {
+  if (window.__addaiLearnInstalled) return;
+  window.__addaiLearnInstalled = true;
+
+  const send = (ev) => {
+    try {
+      if (typeof window.__addaiLearn === 'function') window.__addaiLearn(JSON.stringify(ev));
+    } catch { /* a lesson must never break the page it is watching */ }
+  };
+
+  // Secret tracking has TWO independent triggers on purpose.
+  //
+  // focusin is the obvious one and it is not reliable: a browser window that
+  // does not itself have focus changes activeElement without firing any focus
+  // event at all (headless Chrome does exactly this, and so does a desktop
+  // whose window manager has put another window on top). Relying on it alone
+  // gives a silent failure whose consequence is a password in the timeline.
+  //
+  // So `input` opens a window too. Whatever else is true, a keystroke reaching
+  // a secret field is proof we should already be blind.
+  let secretOpen = false;
+  const openSecret = () => {
+    if (!secretOpen) { secretOpen = true; send({ kind: 'secret_focus' }); }
+  };
+  const closeSecret = () => {
+    if (secretOpen) { secretOpen = false; send({ kind: 'secret_blur' }); }
+  };
+
+  const editable = (t) => {
+    const tag = t && t.tagName ? t.tagName.toLowerCase() : '';
+    return tag === 'input' || tag === 'textarea' || tag === 'select' ||
+      !!(t && t.isContentEditable);
+  };
+
+  document.addEventListener('click', (e) => {
+    send({ kind: 'page_click', target: describe(e.target) });
+    // Deliberately does NOT close a secret window. Pressing "show password" or
+    // "Sign in" mid-entry is a click on something harmless, and closing there
+    // would leave a hole between it and the next keystroke — one that a
+    // coalesced `type` event could land in unredacted. Over-inclusive is the
+    // right direction for redaction; a window closes when focus really moves.
+  }, true);
+
+  const arrivedAt = (t) => {
+    if (isSecret(t)) { openSecret(); return; }
+    if (editable(t)) { closeSecret(); send({ kind: 'page_focus', target: describe(t) }); }
+  };
+
+  document.addEventListener('focusin', (e) => arrivedAt(e.target), true);
+  // The backstop. Never carries what was typed — only that typing happened.
+  document.addEventListener('input', (e) => arrivedAt(e.target), true);
+
+  // A page can be torn down mid-password. Closing the window on unload means
+  // an unclosed one really does mean "we never saw it end".
+  window.addEventListener('pagehide', closeSecret, true);
+
+  document.addEventListener('submit', (e) => {
+    send({ kind: 'submit', target: describe(e.target) });
+  }, true);
+}
+
+/** The exact text handed to Page.addScriptToEvaluateOnNewDocument. */
+export function injectedSource() {
+  return '(function(){\n' +
+    'var describeTarget = ' + describeTarget.toString() + ';\n' +
+    'var isSecretField = ' + isSecretField.toString() + ';\n' +
+    'var pageRecorder = ' + pageRecorder.toString() + ';\n' +
+    'try { pageRecorder(describeTarget, isSecretField); } catch (e) {}\n' +
+    '})();';
+}