appilot 0.1.0 → 0.1.1

package/dist/dom/sensitiveFields.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Which form fields the agent may never read from or write to.
+ *
+ * One rule, consulted by every path that touches a host page's field values, so
+ * that a new executor or a new tool cannot quietly acquire an exemption. Three
+ * separate defects motivated it: `fillForm` listed `password` among its "safe"
+ * settable types, the form-value readers returned `input.value` for every field
+ * including the password, and `read_form_state` (a DOM tool whose description
+ * tells the model to call it before asking the user what they filled in) did the
+ * same on both surfaces.
+ *
+ * It lives in the SDK rather than in `appilot-shared` because the SDK is what
+ * both surfaces load to answer a DOM tool call, and `appilot-shared` cannot be
+ * imported from here. `appilot-shared/scanning` re-exports it, so the rule has
+ * one definition and one import path per package.
+ *
+ * The rule is deliberately about the FIELD, not about who is asking. An agent
+ * turn, an Action Plan step and a client-registered action all run against the
+ * same page with the same authority, so a check that depended on the caller
+ * would be one refactor away from being bypassed.
+ */
+/**
+ * True when a field's TYPE alone makes it sensitive. This is the check available
+ * where only the scanned `FieldInfo` is at hand, with no live element.
+ */
+export declare function isSensitiveFieldType(type: string | null | undefined): boolean;
+/**
+ * True when a live element must not have its value read or written. Checks the
+ * type, the `autocomplete` annotation, and `hidden` inputs, whose values are
+ * server-set state (CSRF tokens, record ids) that the agent has no business
+ * reporting back.
+ */
+export declare function isSensitiveField(element: Element | null | undefined): boolean;

package/dist/dom/sensitiveFields.js

@@ -0,0 +1,72 @@
+/**
+ * Which form fields the agent may never read from or write to.
+ *
+ * One rule, consulted by every path that touches a host page's field values, so
+ * that a new executor or a new tool cannot quietly acquire an exemption. Three
+ * separate defects motivated it: `fillForm` listed `password` among its "safe"
+ * settable types, the form-value readers returned `input.value` for every field
+ * including the password, and `read_form_state` (a DOM tool whose description
+ * tells the model to call it before asking the user what they filled in) did the
+ * same on both surfaces.
+ *
+ * It lives in the SDK rather than in `appilot-shared` because the SDK is what
+ * both surfaces load to answer a DOM tool call, and `appilot-shared` cannot be
+ * imported from here. `appilot-shared/scanning` re-exports it, so the rule has
+ * one definition and one import path per package.
+ *
+ * The rule is deliberately about the FIELD, not about who is asking. An agent
+ * turn, an Action Plan step and a client-registered action all run against the
+ * same page with the same authority, so a check that depended on the caller
+ * would be one refactor away from being bypassed.
+ */
+/** Input types whose value is a credential or a secret in every context. */
+const SENSITIVE_INPUT_TYPES = ['password'];
+/**
+ * `autocomplete` tokens that mark a value as a credential, a payment instrument,
+ * or a second factor. The browser already classifies these for its own autofill;
+ * reusing that vocabulary means a host app that annotates its forms correctly
+ * gets the protection without knowing Appilot exists.
+ */
+const SENSITIVE_AUTOCOMPLETE_TOKENS = [
+    'current-password',
+    'new-password',
+    'one-time-code',
+];
+/** `autocomplete` prefixes covering the whole payment-card family (`cc-number`, `cc-csc`, ...). */
+const SENSITIVE_AUTOCOMPLETE_PREFIXES = ['cc-'];
+/**
+ * True when a field's TYPE alone makes it sensitive. This is the check available
+ * where only the scanned `FieldInfo` is at hand, with no live element.
+ */
+export function isSensitiveFieldType(type) {
+    if (!type)
+        return false;
+    return SENSITIVE_INPUT_TYPES.includes(type.toLowerCase());
+}
+/**
+ * True when a live element must not have its value read or written. Checks the
+ * type, the `autocomplete` annotation, and `hidden` inputs, whose values are
+ * server-set state (CSRF tokens, record ids) that the agent has no business
+ * reporting back.
+ */
+export function isSensitiveField(element) {
+    if (!element)
+        return false;
+    const tagName = element.tagName?.toLowerCase();
+    if (tagName !== 'input' && tagName !== 'textarea' && tagName !== 'select')
+        return false;
+    const input = element;
+    const type = (input.type || '').toLowerCase();
+    if (isSensitiveFieldType(type))
+        return true;
+    if (type === 'hidden')
+        return true;
+    const autocomplete = (input.getAttribute('autocomplete') || '').toLowerCase().trim();
+    if (!autocomplete)
+        return false;
+    // `autocomplete` allows section and billing/shipping qualifiers before the
+    // field token ("section-payment billing cc-number"), so the decision is made
+    // on the tokens rather than on the whole string.
+    return autocomplete.split(/\s+/).some(token => SENSITIVE_AUTOCOMPLETE_TOKENS.includes(token) ||
+        SENSITIVE_AUTOCOMPLETE_PREFIXES.some(prefix => token.startsWith(prefix)));
+}

package/dist/domResponder.js

@@ -27,6 +27,7 @@
 import { httpFetch } from './httpFetch.js';
 import { invokeClientTool } from './webmcp/registry.js';
 import { computeUniqueSelector } from './dom/uniqueSelector.js';
+import { isSensitiveField } from './dom/sensitiveFields.js';
 const MAX_HITS = 20;
 const HIT_LIMIT_HARD = 50;
 const MAX_TEXT_CHARS = 2000;
@@ -193,8 +194,12 @@ function inspectElement(args) {
     if (!el)
         return { error: 'unknown_id', detail: id };
     const attributes = {};
-    for (const attr of Array.from(el.attributes))
-        attributes[attr.name] = attr.value;
+    // A server-rendered `value="..."` on a credential field is the same secret by
+    // another route, so the attribute dump is filtered the same way.
+    const redactValue = isSensitiveField(el);
+    for (const attr of Array.from(el.attributes)) {
+        attributes[attr.name] = redactValue && attr.name === 'value' ? '' : attr.value;
+    }
     const parentChain = [];
     let parent = el.parentElement;
     while (parent && parentChain.length < 8) {
@@ -230,10 +235,16 @@ function readFormState(args) {
         const fields = [];
         for (const fieldEl of form.querySelectorAll('input, select, textarea, [contenteditable]')) {
             const f = fieldEl;
+            // The value is withheld for credential fields, never the field itself:
+            // the agent still needs to know the password input EXISTS and whether it
+            // is filled, so it can reason about the form without reading the secret.
+            const sensitive = isSensitiveField(f);
             fields.push({
                 name: f.name || f.id || accessibleName(f),
                 label: accessibleName(f),
-                value: f.value ?? f.textContent ?? '',
+                value: sensitive ? '' : (f.value ?? f.textContent ?? ''),
+                value_withheld: sensitive || undefined,
+                filled: sensitive ? !!f.value : undefined,
                 visible: isVisible(f),
                 disabled: !!f.disabled,
                 required: !!f.required,

package/dist/runtime.d.ts

@@ -13,3 +13,4 @@ export { httpFetch, type HttpFetchArgs, type HttpFetchResult } from './httpFetch
 export { collectClientTools } from './webmcp/sdk.js';
 export { invokeClientTool, serializeClientTools, normalizeResult, __resetClientToolRegistry, type SerializedClientTool, } from './webmcp/registry.js';
 export { registerFocusedSessionProvider, type FocusedSessionProvider, } from './focusedSessions/pageSdk.js';
+export { isSensitiveField, isSensitiveFieldType } from './dom/sensitiveFields.js';

package/dist/runtime.js

@@ -16,3 +16,6 @@ export { collectClientTools } from './webmcp/sdk.js';
 export { invokeClientTool, serializeClientTools, normalizeResult, __resetClientToolRegistry, } from './webmcp/registry.js';
 // Focused Sessions transport provider (implemented by the assistant surface).
 export { registerFocusedSessionProvider, } from './focusedSessions/pageSdk.js';
+// The one rule about credential fields. Re-exported by `appilot-shared/scanning`
+// for the surfaces that already import it from there.
+export { isSensitiveField, isSensitiveFieldType } from './dom/sensitiveFields.js';

package/dist/widget/boot.d.ts

@@ -11,11 +11,10 @@
  * - Boot does not latch on failure: a failed relay or bundle load returns
  *   availability to 'unavailable' and a later bootAppilotWidget() call retries
  *   from scratch (one hiccup never permanently disables the assistant).
- * - The widget token (TTL ~3600s) is re-relayed at ~80% of its TTL. The fresh
- *   token is written back to the loader script tag (data-user-token) so every
- *   subsequent (re)boot stays authenticated past the hour, AND handed to the
- *   live instance through `window.Appilot.setUserToken` so a long-lived tab
- *   never starts 401ing on a healthy host session.
+ * - The widget token (TTL ~3600s) is re-relayed at ~80% of its TTL and handed
+ *   to the live instance through `window.Appilot.setUserToken`, so a long-lived
+ *   tab never starts 401ing on a healthy host session. The refreshed token is
+ *   NOT written back to the DOM (see "The token and the DOM" below).
  * - The widget can request an out-of-band refresh by dispatching
  *   'appilot:identity-refresh-requested' on window (it does so when its
  *   federated identity is rejected); the loader re-relays immediately.
@@ -30,6 +29,26 @@
  * - Availability is observable (getWidgetAvailability / subscribeWidgetAvailability)
  *   so pages can render an honest "assistant unavailable" state. Pairs with
  *   React useSyncExternalStore(subscribeWidgetAvailability, getWidgetAvailability).
+ *
+ * ## The token and the DOM
+ *
+ * `data-user-token` is a bearer token for the end user. Anything that can read
+ * the host page's DOM can read it and act as that person against the Appilot
+ * backend, so it must not live there.
+ *
+ * Two changes follow. The refresh no longer writes the rotated token back to
+ * the tag: `window.Appilot.setUserToken` already feeds the live instance, and a
+ * later re-boot re-relays a fresh token anyway, so the DOM write bought a
+ * hypothetical reboot path at the price of a token sitting in the page for the
+ * life of the tab, being renewed there every ~48 minutes.
+ *
+ * The boot token still passes through the attribute, because that is the only
+ * channel the shipped widget bundle reads its configuration from, and it is
+ * removed as soon as the bundle has consumed it (`releaseBootToken`). That
+ * shrinks the exposure from the lifetime of the page to the interval between
+ * appending the script and the bundle parsing its config. Closing it entirely
+ * needs the widget to accept a non-DOM handoff; until then, treat the boot
+ * token as short-lived and keep the relay's TTL short.
  */
 export type WidgetAvailability = 'unknown' | 'booting' | 'ready' | 'unavailable';
 export interface AppilotWidgetBootOptions {

package/dist/widget/boot.js

@@ -11,11 +11,10 @@
  * - Boot does not latch on failure: a failed relay or bundle load returns
  *   availability to 'unavailable' and a later bootAppilotWidget() call retries
  *   from scratch (one hiccup never permanently disables the assistant).
- * - The widget token (TTL ~3600s) is re-relayed at ~80% of its TTL. The fresh
- *   token is written back to the loader script tag (data-user-token) so every
- *   subsequent (re)boot stays authenticated past the hour, AND handed to the
- *   live instance through `window.Appilot.setUserToken` so a long-lived tab
- *   never starts 401ing on a healthy host session.
+ * - The widget token (TTL ~3600s) is re-relayed at ~80% of its TTL and handed
+ *   to the live instance through `window.Appilot.setUserToken`, so a long-lived
+ *   tab never starts 401ing on a healthy host session. The refreshed token is
+ *   NOT written back to the DOM (see "The token and the DOM" below).
  * - The widget can request an out-of-band refresh by dispatching
  *   'appilot:identity-refresh-requested' on window (it does so when its
  *   federated identity is rejected); the loader re-relays immediately.
@@ -30,6 +29,26 @@
  * - Availability is observable (getWidgetAvailability / subscribeWidgetAvailability)
  *   so pages can render an honest "assistant unavailable" state. Pairs with
  *   React useSyncExternalStore(subscribeWidgetAvailability, getWidgetAvailability).
+ *
+ * ## The token and the DOM
+ *
+ * `data-user-token` is a bearer token for the end user. Anything that can read
+ * the host page's DOM can read it and act as that person against the Appilot
+ * backend, so it must not live there.
+ *
+ * Two changes follow. The refresh no longer writes the rotated token back to
+ * the tag: `window.Appilot.setUserToken` already feeds the live instance, and a
+ * later re-boot re-relays a fresh token anyway, so the DOM write bought a
+ * hypothetical reboot path at the price of a token sitting in the page for the
+ * life of the tab, being renewed there every ~48 minutes.
+ *
+ * The boot token still passes through the attribute, because that is the only
+ * channel the shipped widget bundle reads its configuration from, and it is
+ * removed as soon as the bundle has consumed it (`releaseBootToken`). That
+ * shrinks the exposure from the lifetime of the page to the interval between
+ * appending the script and the bundle parsing its config. Closing it entirely
+ * needs the widget to accept a non-DOM handoff; until then, treat the boot
+ * token as short-lived and keep the relay's TTL short.
  */
 const DEFAULT_APPILOT_API_URL = 'http://localhost:6001';
 /** Dispatched by the widget when its federated identity is rejected (401),
@@ -50,6 +69,32 @@ let bootAbortController = null;
 let activeAttempt = 0;
 let warnedMissingConfig = false;
 let refreshRequestListener = null;
+/**
+ * Marks OUR loader tag without naming the token. The tag was previously found
+ * by `[data-user-token]`, which stops working the moment the token is removed,
+ * and this attribute is deliberately not one the widget's config parser matches
+ * (it looks for the exact names `data-api-key`, `data-user-token`,
+ * `data-appilot`).
+ */
+const LOADER_MARKER_ATTR = 'data-appilot-loader';
+/**
+ * Drop the boot token from the DOM once the widget has read its config.
+ *
+ * The bundle parses its config at module evaluation, which is over by the time
+ * `load` fires. The one exception is a document still parsing when the script
+ * executes: the widget then defers its auto-init to DOMContentLoaded, so this
+ * defers with it. Our listener is registered from inside the load handler,
+ * after the bundle registered its own, and DOMContentLoaded listeners run in
+ * registration order.
+ */
+function releaseBootToken(script) {
+    const drop = () => script.removeAttribute('data-user-token');
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', drop, { once: true });
+        return;
+    }
+    drop();
+}
 function detachRefreshRequestListener() {
     if (refreshRequestListener) {
         window.removeEventListener(IDENTITY_REFRESH_REQUESTED_EVENT, refreshRequestListener);
@@ -154,11 +199,11 @@ async function refreshWidgetToken(options) {
     }
     try {
         const relayed = await relayWidgetToken(options);
-        // Keep the loader tag fresh so any widget (re)boot past the original TTL
-        // stays authenticated.
-        scriptEl?.setAttribute('data-user-token', relayed.token);
-        // Feed the live instance so an open tab adopts the fresh token without
-        // a reload (`window.Appilot.setUserToken`, widget >= 2026-08-25).
+        // The rotated token goes to the live instance ONLY. Writing it back to
+        // the loader tag put a live bearer token for the signed-in user in the
+        // host page's DOM, readable by every script on the page, and refreshed
+        // there for as long as the tab stayed open.
+        // (`window.Appilot.setUserToken`, widget >= 2026-08-25.)
         const appilot = window.Appilot;
         appilot?.setUserToken?.(relayed.token);
         scheduleTokenRefresh(relayed.expiresIn, options);
@@ -212,6 +257,7 @@ export async function bootAppilotWidget(options) {
     const script = document.createElement('script');
     script.src = options.widgetScriptUrl;
     script.async = true;
+    script.setAttribute(LOADER_MARKER_ATTR, '');
     if (options.widgetKey)
         script.dataset.apiKey = options.widgetKey;
     script.dataset.apiUrl = options.appilotApiUrl || DEFAULT_APPILOT_API_URL;
@@ -234,6 +280,9 @@ export async function bootAppilotWidget(options) {
         clearBootTimer();
         bootAbortController = null;
         setAvailability('ready');
+        // The bundle has its config; the token has no further reason to be in
+        // the page.
+        releaseBootToken(script);
         scheduleTokenRefresh(relayed.expiresIn, options);
         attachRefreshRequestListener(options);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appilot",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Appilot SDK: the single developer-facing surface for building on Appilot. Boot the assistant (bootAppilotWidget), register client actions (registerTool, WebMCP-aligned), and run Focused Sessions (startFocusedSession). Browser-only, React-free, zero runtime dependencies.",
   "homepage": "https://appilot.space",
   "author": "BetterKnow GmbH",