@unotest/grounder-client 0.43.0 → 0.43.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.43.1] - 2026-09-29
+
+### Patch Changes
+
+- 5433bab: Secret field values no longer leak into failures and replies. An
+  `assertValue` failure on a field marked as a credential (`type="password"`,
+  or `autocomplete` of `current-password`, `new-password` or `one-time-code`)
+  reports only the lengths of the two values, for example
+  `expected ‹hidden, 12 chars›, got ‹hidden, 32 chars›`. The same fields are
+  no longer read by the grounding capture, and show as `‹hidden, N chars›` in
+  a failure's page HTML and in a fill recorded by the viewer. MCP replies now
+  mask registered secrets as `‹secret:NAME›`, as the session journal already
+  did: text, structured content and tool error messages.
+
+  **What to check if you ran 0.43.0 or earlier.** The value of a password or
+  one-time-code field, and the value of a secret from `unotest/.secrets`, could
+  appear in plain text in MCP tool replies (for example `assert_text`,
+  `check_locator`, `assert_value` and the `get_failure_*` tools), in the text
+  of an `assertValue` failure, and in the `page.html` and `failure.json` saved
+  with a failed run. Search your MCP client's transcripts and your saved run
+  failures for your secrets and credentials; if one is there, rotate it.
+
 ## [0.43.0] - 2026-09-27
 
 ## [0.42.0] - 2026-09-24

package/dist/dom-walker/index.js

@@ -514,11 +514,18 @@ function captureRawTree(h) {
     }
     return h.cap(phrase);
   }
+  const SECRET_AUTOCOMPLETE = ["current-password", "new-password", "one-time-code"];
+  function isSecretField(el) {
+    if ((el.getAttribute("type") ?? "").trim().toLowerCase() === "password") return true;
+    const tokens = (el.getAttribute("autocomplete") ?? "").toLowerCase().split(/\s+/);
+    return tokens.some((token) => SECRET_AUTOCOMPLETE.includes(token));
+  }
   function controlValue(el) {
     const tag = el.tagName.toLowerCase();
+    if ((tag === "input" || tag === "textarea") && isSecretField(el)) return void 0;
     if (tag === "input") {
       const t = (el.type || "text").toLowerCase();
-      if (t === "checkbox" || t === "radio" || t === "button" || t === "submit" || t === "reset" || t === "image" || t === "password" || t === "hidden") {
+      if (t === "checkbox" || t === "radio" || t === "button" || t === "submit" || t === "reset" || t === "image" || t === "hidden") {
         return void 0;
       }
       const v = h.trim(el.value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unotest/grounder-client",
-  "version": "0.43.0",
+  "version": "0.43.1",
   "description": "Client contract for the unotest semantic UI grounder: typed intent/resolution types, the injectable DOM walker (RawCapture), the content hash, and the HTTP client + wire protocol of the grounding service. The grounding engine itself is a private service; this package is everything a consumer needs to capture a page and talk to it.",
   "license": "MIT",
   "publishConfig": {