cdpilot 0.9.6 → 0.9.7

package/src/cdpilot.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-cdpilot — Zero-dependency browser automation from your terminal.
+cdpilot — Zero-npm-dependency browser automation from your terminal.
 
 Controls any Chromium-based browser (Brave, Chrome, Chromium) via the
 Chrome DevTools Protocol (CDP). No Puppeteer, no Playwright, no Selenium.
@@ -39,7 +39,8 @@ Environment:
   CDPILOT_PROFILE      Isolated browser profile directory
   CDPILOT_LOG=0        Do not write the session log
   CDPILOT_VAR_<NAME>   Value for flow placeholder {{name}} in replay / agent run
-  CDPILOT_VAR_HOSTS    Hosts (comma-separated) an agent flow may type CDPILOT_VAR_* values on
+  CDPILOT_VAR_HOSTS    Hosts (comma-separated; host:port for a non-default port) an agent
+                       flow or a replayed input step may type CDPILOT_VAR_* values on (https)
   CDPILOT_TIMEOUT      Default for --timeout (the flag wins)
   CDPILOT_DAEMON=1     Keep one warm Python process per project and send page
                        commands to it over a local socket (fresh process when
@@ -91,17 +92,23 @@ Record & replay:
   cdpilot record cancel                    Cancel and discard active recording
   cdpilot record stop [--save <file.json>] Stop recording and emit flow JSON
   cdpilot replay <file.json> [--var k=v] [--delay real|none|<ms>] [--dry-run] [--continue]
-                       Replay a recorded flow with variable substitution
+                       Replay a recorded flow with variable substitution. --var fills any
+                       {{name}}; CDPILOT_VAR_<NAME> fills only the value of an input step
+                       (fill/type/smart-fill/…) on an https page whose host CDPILOT_VAR_HOSTS
+                       names, checked before and while typing, and only in a flow with no
+                       eval/run/batch-like step; go/eval and other commands take --var (exit 2)
 
 Exit codes: 0 ok, 1 error (batch / run: a step failed), 124 --timeout;
+  2 agent: unknown flow, missing or refused variable, {{placeholder}} in --text/--url;
   exit 3 from click / smart-click (batch / run: one, and no failed step):
   pressed, release missed the target, not clicked (a real mouse click whose
   target moved or got covered under the press; see the stderr note). A target
   the page replaced or navigated away from on mousedown prints
-  "Pressed (the page replaced or left it ...)" and exits 0.
+  "Pressed (the page replaced or left it ...)" and exits 0;
+  4 agent run: drift (page observation on stdout).
 """
 
-__version__ = "0.9.6"
+__version__ = "0.9.7"
 
 import asyncio
 import atexit
@@ -1702,9 +1709,39 @@ def _autolaunch_if_down():
     return False
 
 
+def _external_override_message():
+    """If CDP_PORT in the environment overrides an external browser's port in
+    the registry, return the override advice message; otherwise None."""
+    project_id = globals().get("PROJECT_ID")
+    if not project_id:
+        return None
+    registry = _load_registry()
+    entry = registry.get(project_id)
+    if not isinstance(entry, dict) or not entry.get("external"):
+        return None
+    reg_port = _as_port(entry.get("port"))
+    if reg_port is None:
+        return None
+    env_port_str = os.environ.get("CDP_PORT")
+    if not env_port_str or env_port_str == "0":
+        return None
+    env_port = _as_port(env_port_str)
+    if env_port is None:
+        return None
+    cur_port = globals().get("CDP_PORT")
+    if cur_port != env_port or cur_port == reg_port:
+        return None
+    return (f"cdpilot: CDP_PORT={env_port} in the environment overrides the "
+            f"connected browser on port {reg_port}; unset CDP_PORT or set it to {reg_port}")
+
+
 def _external_gone_exit():
     """The connected (external) browser stopped answering: say so, exit 1.
     Never launches a replacement."""
+    override = _external_override_message()
+    if override:
+        print(override, file=sys.stderr)
+        sys.exit(1)
     print(f"cdpilot: {EXTERNAL_GONE}", file=sys.stderr)
     sys.exit(1)
 
@@ -4868,6 +4905,10 @@ def _frame_aware(kind="css"):
         async def wrapper(target, *args, **kwargs):
             if _FRAME_ROUTE.get() is not None or not isinstance(target, str):
                 return await fn(target, *args, **kwargs)
+            if _replay_strict_rule() is not None and (_FRAME_FLAG or FRAME_SEP in target):
+                # a replayed environment value never goes into a frame (no lookup either)
+                _replay_strict_refuse(fn.__name__.replace('cmd_', '').replace('_', '-'),
+                                      'never inside a frame (>>>, --frame)')
             try:
                 flag_hops = _parse_frame_spec(_FRAME_FLAG) if _FRAME_FLAG else []
             except ValueError as e:
@@ -7108,6 +7149,10 @@ def cmd_launch(auto=False, idle_close=None):
             print(f'Connected browser in use on port {CDP_PORT} (external); '
                   'no cdpilot browser launched. `cdpilot disconnect` to use one.')
             return
+        override = _external_override_message()
+        if override:
+            print(override, file=sys.stderr)
+            sys.exit(1)
         print(EXTERNAL_GONE, file=sys.stderr)
         sys.exit(1)
     # This command's own flags (sys.argv minus --timeout); none for auto-launch.
@@ -7299,7 +7344,8 @@ def cmd_launch(auto=False, idle_close=None):
         print(f'  WebMCP: on (--enable-features={WEBMCP_FEATURE})')
 
     try:
-        proc = subprocess.Popen(chrome_args, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
+        # Nothing reads the pipe; a browser outliving a long-lived (warm) process must not block on a full or closed pipe.
+        proc = subprocess.Popen(chrome_args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     except OSError as e:
         # Windows' FileNotFoundError ("[WinError 2] The system cannot find the
         # file specified") does not name the binary; say which one, on every OS,
@@ -7755,7 +7801,7 @@ async def cmd_eval_batch(exprs_json):
       observations (e.g. read 12 DOM values to fill a report), N sequential
       `eval` commands cost N × roundtrip. This packs them into one IIFE that
       runs all N expressions and returns the result array — one roundtrip
-      total. Typical speedup: 5-30x for batches of 5+ expressions.
+      total. Run N JS expressions in one process and one CDP roundtrip instead of N.
     """
     try:
         exprs = json.loads(exprs_json) if isinstance(exprs_json, str) else exprs_json
@@ -8394,6 +8440,15 @@ async def cmd_click(selector, ladder=None, no_heal=False, entropy=None):
 
 @_frame_aware("css")
 async def cmd_fill(selector, value, ladder=None, no_heal=False, entropy=None):
+    strict = _replay_strict_rule()
+    if strict is not None:
+        # A replayed environment value: never inside a frame, never typed key
+        # by key (--entropy=on: the keys follow focus wherever it moves).
+        if _FRAME_ROUTE.get() is not None:
+            _replay_strict_refuse('fill', 'never inside a frame (>>>, --frame)')
+        if entropy:
+            _replay_strict_refuse('fill', 'never with humanized typing (--entropy=on)')
+        entropy = False
     ws, _ = get_page_ws()
     if entropy is None:
         try:
@@ -8411,8 +8466,27 @@ async def cmd_fill(selector, value, ladder=None, no_heal=False, entropy=None):
     if len(tried) > 1 or (tried and not tried[0]["hit"]):
         _log_heal("fill", selector, tried, dur, no_heal)
     safe_sel = json.dumps(res_sel)
-    safe_value = json.dumps(value)
     wait_ms = get_auto_wait_ms()
+    if strict is not None:
+        find_js = f"""
+(function() {{
+{WAIT_AND_QUERY_JS}
+    return __cdpilot_waitFor({safe_sel}, {wait_ms}).then(function(el) {{
+        /* cdpilot-var-find */
+        if (!el) return 'Timeout waiting for: ' + {safe_sel};
+        if (el.hasAttribute('data-cdpilot-tmp')) el.removeAttribute('data-cdpilot-tmp');
+        return el;
+    }});
+}})()"""
+        out = await _replay_strict_act(ws, find_js, _replay_strict_value('fill', value), strict, 'fill')
+        if out.get('refused'):
+            _replay_strict_refuse('fill', out['refused'])
+        if not out.get('ok'):
+            print(out.get('missing') or f"Error: selector '{selector}' not resolved.", file=sys.stderr)
+            sys.exit(1)
+        print(f"Filled: {out.get('tag', '?')} (value not shown)")
+        return
+    safe_value = json.dumps(value)
     if entropy:
         # Focus element, field-focus pause, then humanize typing
         js_focus = f"""
@@ -13907,6 +13981,14 @@ def _do_connect(port, ws_url, version_info, browser_name):
     print(f"  Tabs: {tab_count}")
     print("  Commands now run in YOUR browser; cdpilot will never close it.")
 
+    env_port_str = os.environ.get("CDP_PORT")
+    if env_port_str and env_port_str != "0":
+        env_port = _as_port(env_port_str)
+        if env_port is not None and env_port != port:
+            print(f"cdpilot: CDP_PORT={env_port} in the environment overrides the "
+                  f"connected browser on port {port}; unset CDP_PORT or set it to {port}",
+                  file=sys.stderr)
+
 
 def _forget_project_tabs():
     """Drop this project's session and tab records. A session made before
@@ -14494,7 +14576,8 @@ async def cmd_smart_click(text):
     """Click element by visible text — fuzzy matching, no CSS selector needed.
 
     Like Stagehand's act("Click login") but without LLM.
-    Searches: button text, link text, aria-label, placeholder, title, value.
+    Searches: button text, link text, aria-label, placeholder, title, the value of a
+    button-like <input> (never a text field's typed value).
 
     Usage:
         cdpilot smart-click "Login"
@@ -14574,12 +14657,16 @@ async def cmd_smart_click(text):
         var style = window.getComputedStyle(el);
         if (style.display === 'none' || style.visibility === 'hidden') return;
 
+        // .value is a label only on a button-like <input>; a text field caught by
+        // [tabindex] holds what was typed (round-2 review: smart-click matched it).
+        var labelValue = el.tagName === 'INPUT' && /^(submit|button|reset)$/i.test(el.type || '')
+          ? (el.value || '') : '';
         var texts = [
           el.textContent || '',
           el.getAttribute('aria-label') || '',
           el.getAttribute('title') || '',
           el.getAttribute('placeholder') || '',
-          el.value || '',
+          labelValue,
           el.getAttribute('alt') || ''
         ];
 
@@ -14902,9 +14989,14 @@ async def cmd_smart_fill(text, value):
         cdpilot smart-fill "Password" "secret123"
         cdpilot smart-fill "Search" "cdpilot"
     """
+    strict = _replay_strict_rule()
+    if strict is not None and _FRAME_ROUTE.get() is not None:
+        _replay_strict_refuse('smart-fill', 'never inside a frame (>>>, --frame)')
     ws_url, _ = get_page_ws()
     safe_text = json.dumps(text.lower())
-    safe_value = json.dumps(value)
+    # A replayed environment value is not part of the script: the script
+    # returns the field and _VAR_TARGET_FN checks and fills it.
+    safe_value = 'null' if strict is not None else json.dumps(value)
     js = f"""
     (function() {{
       // Shadow DOM traversal — same helper as smart-click. Custom-element
@@ -15015,6 +15107,7 @@ async def cmd_smart_fill(text, value):
       var best = candidates[0];
       // Frame-search probe (_smart_wrap probe=True): report the hit, never type.
       if (typeof __cdpilotProbe !== 'undefined' && __cdpilotProbe) return JSON.stringify({{found: true, probe: true, score: best.score}});
+      {'/* cdpilot-var-find */ return best.el;' if strict is not None else ''}
 
       // React-compatible value setting
       var nativeSetter = Object.getOwnPropertyDescriptor(
@@ -15040,6 +15133,15 @@ async def cmd_smart_fill(text, value):
       }});
     }})()
     """
+    if strict is not None:  # the top-level page only: no frame search
+        out = await _replay_strict_act(ws_url, js, _replay_strict_value('smart-fill', value), strict, 'fill')
+        if out.get('refused'):
+            _replay_strict_refuse('smart-fill', out['refused'])
+        if not out.get('ok'):
+            print(f'No input found matching: "{text}"', file=sys.stderr)
+            sys.exit(1)
+        print(f'Filled: {out.get("tag", "?")} "{text}" (value not shown)')
+        return
     raw = await _smart_eval(ws_url, js, "smart-fill", same_origin_only=True)
     try:
         data = json.loads(raw)
@@ -15063,9 +15165,13 @@ async def cmd_smart_select(text, option_text):
         cdpilot smart-select "Country" "Turkey"
         cdpilot smart-select "Size" "Large"
     """
+    strict = _replay_strict_rule()
+    if strict is not None and _FRAME_ROUTE.get() is not None:
+        _replay_strict_refuse('smart-select', 'never inside a frame (>>>, --frame)')
     ws_url, _ = get_page_ws()
     safe_text = json.dumps(text.lower())
-    safe_option = json.dumps(option_text.lower())
+    # A replayed environment value (the option) is not part of the script, as in smart-fill.
+    safe_option = 'null' if strict is not None else json.dumps(option_text.lower())
     js = f"""
     (function() {{
       // Shadow DOM + locale-aware comparison — same conventions as smart-click
@@ -15136,6 +15242,7 @@ async def cmd_smart_select(text, option_text):
       }}
       // Frame-search probe (_smart_wrap probe=True): report the hit, never select.
       if (typeof __cdpilotProbe !== 'undefined' && __cdpilotProbe) return JSON.stringify({{found: true, probe: true, score: bestScore}});
+      {'/* cdpilot-var-find */ return best;' if strict is not None else ''}
 
       // Find matching option
       var options = Array.from(best.options);
@@ -15152,6 +15259,17 @@ async def cmd_smart_select(text, option_text):
       return JSON.stringify({{found: true, optionFound: true, selected: match.text, value: match.value}});
     }})()
     """
+    if strict is not None:  # the top-level page only: no frame search
+        out = await _replay_strict_act(ws_url, js, _replay_strict_value('smart-select', option_text),
+                                       strict, 'select')
+        if out.get('refused'):
+            _replay_strict_refuse('smart-select', out['refused'])
+        if not out.get('ok'):
+            print(f'No select found matching: "{text}"' if not out.get('missing', '').startswith('no option')
+                  else f'Option not found in the select matching "{text}" (option not shown)', file=sys.stderr)
+            sys.exit(1)
+        print(f'Selected an option in "{text}" (value not shown)')
+        return
     raw = await _smart_eval(ws_url, js, "smart-select", same_origin_only=True)
     try:
         data = json.loads(raw)
@@ -15508,6 +15626,27 @@ async def cmd_assert_value(selector, expected_value):
     """Assert an input/textarea/select element's value equals expected_value."""
     ws_url, _ = get_page_ws()
     safe_sel = json.dumps(selector)
+    strict = _replay_strict_rule()
+    if strict is not None:
+        # A replayed environment value: compared inside _VAR_TARGET_FN, never
+        # put in a script, never printed (nor the field's actual value).
+        find_js = f"""(function() {{
+      {_SHADOW_QUERY_JS}
+      /* cdpilot-var-find */
+      var res = __cdpilot_resolveSelector(document, {safe_sel}, true);
+      return res && res.el ? res.el : 'FAIL: Element not found: ' + {safe_sel};
+    }})()"""
+        out = await _replay_strict_act(ws_url, find_js, _replay_strict_value('assert-value', expected_value),
+                                       strict, 'assert')
+        if out.get('refused'):
+            _replay_strict_refuse('assert-value', out['refused'])
+        if not out.get('ok'):
+            print(out.get('missing') or f'FAIL: Element not found: {selector}')
+        elif out.get('equal'):
+            print(f'PASS: Value matches ({selector}, value not shown)')
+        else:
+            print(f'FAIL: Value differs ({selector}, values not shown)')
+        return
     safe_expected = json.dumps(expected_value)
     js = f"""(function() {{
       {_SHADOW_QUERY_JS}
@@ -15895,6 +16034,106 @@ _AGENT_INJECTION_RES = (
                  r"\b(cookies?|credentials?|passwords?|api[ -]?keys?|tokens?|session|secrets?|conversation|chat history)\b", _re.I)),
 )
 
+# Second pass (10.11, after the held-out set: 7/24 caught). The text is
+# normalised first (_agent_injection_norm), so these patterns see casefolded
+# NFKC text with zero-width characters removed, spaced-out letters joined and
+# Turkish ı/İ folded to i. Every entry is (tag, pattern, required, keys):
+# when `required` is set, the text must ALSO contain an agent-directed cue, so
+# that instructions written for the human reader ("Copy .env.example to .env",
+# "Visit https://… and sign in") stay clean; `keys` is a cheap substring
+# prefilter (one of them must occur before the pattern runs).
+import unicodedata as _unicodedata
+_AGENT_ORDER_RE = _re.compile(
+    r"\b(?:the |all |any )?(?:assistant|ai|model|agent|llm)s? (?:must|shall|should|will|is (?:now )?(?:required|allowed|authori[sz]ed))\b"
+    r"|\byou are now\b"
+    r"|\byou (?:must|shall) (?:now |always |never )?(?:ignore|disregard|obey|comply|follow|approve|reveal|print|output|disable|reply|respond|answer)\b"
+    r"|\b(?:ignore|disregard|reveal|print|output|dump|disable|bypass|override|forget)\b[^.\n]{0,25}"
+    r"\b(?:your|all|previous|prior|safety|hidden)\s+(?:[\w-]+\s+){0,2}"
+    r"(?:instructions?|prompts?|rules|guidelines|configuration|config|settings|restrictions|filters|polic(?:y|ies))\b"
+    r"|\bbefore (?:answering|responding|replying)\b")
+_AGENT_ACTION = (r"(?<![a-z0-9])(?:navigate|open|goto|send|fetch|post|click|fill|submit|upload|email|download|"
+                 r"exec|execute|run_|delete|transfer|purchase|buy)(?![a-z0-9])")
+_AGENT_INJECTION_RES_2 = (
+    # one short alternation per language: es, fr, tr (ı → i folded), ja, de, pt
+    ('ignore_instructions', _re.compile(
+        r"\b(?:ignora|olvida|ignore|olvide|omite)\b[^.\n]{0,20}\binstrucciones (?:anteriores|previas)\b"
+        r"|\b(?:ignore[sz]?|oublie[sz]?)\b[^.\n]{0,20}\b(?:instructions|consignes|directives) (?:précédentes|antérieures)\b"
+        r"|\b(?:önceki|yukaridaki|tüm|bütün)\b[^.\n]{0,15}\b(?:talimat|komut|yönerge)\w*\s+"
+        r"(?:unut(?:un)?|yok say(?:in)?|görmezden gel(?:in)?|dikkate alma(?:yin)?)\b"
+        r"|(?:以前|前|これまで|上記|先)の(?:指示|命令|指令)(?:を|は)?(?:すべて|全て)?無視"
+        r"|\b(?:ignoriere|ignorieren sie|vergiss|vergessen sie|übergehe|missachte)\b[^.\n]{0,20}"
+        r"\b(?:vorherigen|bisherigen|früheren|obigen) (?:anweisungen|instruktionen|befehle|regeln)\b"
+        r"|\b(?:ignore|ignora|esqueça|esqueca|desconsidere)\b[^.\n]{0,20}\binstruções (?:anteriores|prévias)\b"), None,
+     ('instru', 'consign', 'directiv', 'talimat', 'komut', 'yönerge', '指示', '命令', '指令', 'anweis', 'befehl', 'regeln')),
+    ('addresses_ai', _re.compile(
+        r"\b(?:ignore|disregard|forget)\b (?:everything|anything|all|whatever)(?: (?:that|else))? "
+        r"you(?:'ve| have| were| had)? (?:been )?(?:told|taught|instructed|given|programmed)\b"
+        r"|\b(?:ai|llm) (?:assistants?|agents?|models?|systems?)\b[^.\n]{0,20}\b(?:reading|visiting|processing|browsing|parsing) this\b"
+        r"|\b(?:llms|large language models|language models|autonomous (?:ai )?agents?)\b[^.\n]{0,20}"
+        r"\b(?:reading|visiting|processing|browsing|parsing) this\b"
+        r"|\b(?:message|note|notice|attention|instructions?) (?:for|to) (?:all |any |the )?autonomous (?:ai )?agents?\b"
+        r"|\bautonomous (?:ai )?agents?\s*:"
+        r"|\b(?:the|your) (?:user|human|owner|operator)\b[^.\n]{0,10}\b(?:would|will|'d)(?: really| definitely| surely)? "
+        r"(?:want|like|prefer) (?:you|the (?:assistant|agent|ai|model)) to\b"
+        r"|\b(?:the|your) (?:user|human) (?:really )?wants (?:you|the (?:assistant|agent|ai|model)) to\b"), None,
+     ('you', 'this', 'autonomous')),
+    ('exfiltrate', _re.compile(
+        r"\b(?:include|append|copy|read|paste|post|send|upload|attach|insert|output|print|dump|leak)\b[^.\n]{0,60}"
+        r"(?:document\.cookie|\blocalstorage\b|\bsessionstorage\b|\bform (?:fields?|contents|data|values)\b"
+        r"|\b(?:every|each|all) (?:form )?fields?\b|~/\.ssh|\.ssh/|\bid_(?:rsa|ed25519|ecdsa)\b|(?<![\w.])\.env\b"
+        r"|\b(?:session|bearer|auth|access) tokens?\b|\bsaved (?:passwords|addresses|cards|credit cards|payment)\b"
+        r"|\bprivate keys?\b)"),
+     _re.compile(r"\byour (?:next )?(?:reply|replies|answer|response|output|summary)\b(?! headers?| body| object)"
+                 r"|\binto (?:the|this) (?:comment|search|chat|text|message|input|feedback) (?:box|field|form)\b"
+                 r"|\bthe user (?:has )?(?:filled|entered|typed|saved|provided)\b"
+                 r"|\bfrom (?:the|this) (?:local|user's|host) (?:machine|computer|disk)\b"
+                 r"|\byou (?:have access to|can access|can see|can read)\b"
+                 r"|\bbefore (?:answering|responding|replying)\b"),
+     ('cookie', 'storage', 'field', 'form ', 'ssh', 'id_', '.env', 'token', 'saved ', 'private key')),
+    # a line starting with SYSTEM: / [SYSTEM] / <system> / "developer message:", or "debug mode enabled",
+    # followed by an order to the agent ("System requirements: …", "Developer mode lets you …" stay clean)
+    ('fake_system', _re.compile(
+        r"(?m)^[ \t>*#-]*(?:\[(?:system|sys|admin)\]|<\|?system\|?>|<\|im_start\|>system"
+        r"|(?:system|developer message|admin(?:istrator)? message)\s*:)"
+        r"|\b(?:developer|debug|admin|god|jailbreak|maintenance) mode\b[^.\n]{0,15}"
+        r"\b(?:enabled|activated|engaged|unlocked|is on|turned on)\b"), _AGENT_ORDER_RE,
+     ('system', 'developer message', 'admin', ' mode')),
+    # JSON / XML imitating a tool call that names an action (a docs example calling "search" stays clean)
+    ('tool_call', _re.compile(
+        r"\"(?:tool|tool_name|function|name|action)\"\s*:\s*\"[^\"\n]{0,40}?" + _AGENT_ACTION + r"[^\"\n]{0,40}\""
+        r"[\s\S]{0,200}?\"(?:arguments|parameters|params|args|input)\"\s*:"
+        r"|<(?:tool_call|function_calls?|invoke|tool_use)\b[\s\S]{0,300}?" + _AGENT_ACTION), None, ('"', '<')),
+    # open/visit a URL + an agent-directed cue; plain "Visit https://… and sign in" for the reader stays clean
+    ('navigate_order', _re.compile(
+        r"\b(?:open|navigate to|go to|visit|browse to|load)\s+(?:the (?:url|link|page|site)\s+)?(?:https?://|www\.)\S"),
+     _re.compile(r"\b(?:ai|llm|browsing|autonomous|web) (?:agents?|assistants?|models?)\b"
+                 r"|\b(?:chatgpt|claude|gemini|copilot|assistant|agent|ai|llm)\s*[,:]"
+                 r"|\b(?:the |you,? )assistant (?:must|should|will|needs)\b"
+                 r"|\bbefore (?:answering|responding|replying)\b"
+                 r"|\binstead of (?:on |using |at )?(?:this|the current|the original) (?:site|page|website|domain)\b"
+                 r"|\bwithout (?:telling|asking|informing|notifying) the user\b|\byour (?:task|instructions)\b"),
+     ('http', 'www.')),
+)
+_AGENT_ZW_RE = _re.compile('[\u200b-\u200d\u2060\ufeff\u00ad]')
+# one substring test for the whole second pass (skips it for most nodes)
+_AGENT_KEYS_RE = _re.compile('|'.join(_re.escape(k) for e in _AGENT_INJECTION_RES_2 for k in e[3]))
+# >= 5 single letters separated by one space or dot: "i g n o r e" -> "ignore"; words are not joined
+_AGENT_SPACED_RE = _re.compile(r"(?<!\w)(?:[^\W\d_][ .]){4,}[^\W\d_](?!\w)")
+_AGENT_SPACED_HINT = _re.compile(r"\b[^\W\d_][ .][^\W\d_][ .][^\W\d_][ .][^\W\d_][ .][^\W\d_]\b")   # cheaper test
+
+
+def _agent_injection_norm(name):
+    """Matching form of an accessible name (the original stays in the output)."""
+    if name.isascii():   # no zero-width characters, no ı/İ; casefold == lower
+        t = name.lower()
+    else:
+        t = _unicodedata.normalize('NFKC', _AGENT_ZW_RE.sub('', name)).casefold()
+        if 'ı' in t or '\u0307' in t:   # casefold turns İ into i + U+0307
+            t = t.replace('ı', 'i').replace('\u0307', '')
+    if _AGENT_SPACED_HINT.search(t):
+        t = _AGENT_SPACED_RE.sub(lambda m: m.group(0).replace(' ', '').replace('.', ''), t)
+    return t
+
 
 def _agent_injection_scan(nodes, limit=5):
     """Nodes whose accessible name reads like instructions to an AI agent:
@@ -15906,11 +16145,15 @@ def _agent_injection_scan(nodes, limit=5):
         name = node.get('name', {}).get('value', '') or ''
         if len(name) < 12 or name in seen:
             continue
-        for tag, rx in _AGENT_INJECTION_RES:
-            if rx.search(name):
-                seen.add(name)
-                out.append({'text': name[:160], 'match': tag})
-                break
+        norm = _agent_injection_norm(name)
+        tag = next((t for t, rx in _AGENT_INJECTION_RES if rx.search(norm)), None)
+        if tag is None and _AGENT_KEYS_RE.search(norm):
+            tag = next((t for t, rx, need, keys in _AGENT_INJECTION_RES_2
+                    if any(k in norm for k in keys) and rx.search(norm)
+                    and (need is None or need.search(norm))), None)
+        if tag is not None:
+            seen.add(name)
+            out.append({'text': name[:160], 'match': tag})
         if len(out) >= limit:
             break
     return out
@@ -16157,6 +16400,38 @@ async def _agent_perform(ref, action, text, old_map):
         sys.exit(1)
 
 
+async def _agent_type_placeholder(ref, value, origin, old_map, from_env=False):
+    """`agent run`: set a placeholder's value on the node `ref` names, in one
+    Runtime.callFunctionOn that requires the node in the top-level page, an
+    input / textarea / contenteditable (never an iframe), and the page's origin
+    equal to `origin` (the recorded one; for a flow saved with a host only, the
+    page's own, whose host matched). An environment value (`from_env`) never
+    goes into a search or url field. None when set, else why (no value)."""
+    if not origin:
+        return 'the page has an opaque origin'
+    bid = old_map[ref]['backend_node_id']
+    ws_url, _ = get_page_ws()
+    global _WS_POOL_ENABLED
+    was, _WS_POOL_ENABLED = _WS_POOL_ENABLED, True  # an objectId lives in one CDP session
+    try:
+        await cdp_send(ws_url, [(1, 'DOM.enable', {})])
+        res_r = await cdp_send(ws_url, [(2, 'DOM.resolveNode', {
+            'backendNodeId': bid, 'objectGroup': _VAR_TARGET_GROUP})])
+        oid = res_r.get(2, {}).get('object', {}).get('objectId')
+        if not oid:
+            return 'the field is gone'
+        out = await _var_target_call(ws_url, oid, value,
+                                     {'kind': 'fill', 'origin': origin, 'hosts': None, 'ce': True,
+                                      'noUrlFields': bool(from_env)})
+    finally:
+        try:
+            await cdp_send(ws_url, [(3, 'Runtime.releaseObjectGroup', {'objectGroup': _VAR_TARGET_GROUP})])
+        except Exception:
+            pass
+        _WS_POOL_ENABLED = was
+    return None if out.get('ok') else (out.get('refused') or out.get('missing') or 'not set')
+
+
 async def cmd_agent_act(ref=None, url=None, action='click', text=None):
     """Perform action, return diff observation."""
     state = _load_agent_state()
@@ -16360,12 +16635,47 @@ def _agent_origin(url):
 AGENT_VAR_HOSTS_ENV = 'CDPILOT_VAR_HOSTS'
 
 
+def _var_host_entries(raw=None):
+    """CDPILOT_VAR_HOSTS (or `raw`) as [(host, port or None)]. An entry is `host`
+    (the scheme's default port; a listed host covers its subdomains) or
+    `host:port` / `[v6]:port` (that port only). Lower-case, leading dots dropped;
+    an entry with a port that is not a number names nothing."""
+    raw = os.environ.get(AGENT_VAR_HOSTS_ENV, '') if raw is None else raw
+    out = []
+    for e in raw.split(','):
+        e = e.strip().lower()
+        if not e:
+            continue
+        host, port = e, None
+        if e.startswith('['):
+            host, _, rest = e[1:].partition(']')
+            if rest:
+                if not (rest.startswith(':') and rest[1:].isdigit()):
+                    continue
+                port = int(rest[1:])
+        elif e.count(':') == 1:
+            host, _, p = e.partition(':')
+            if not p.isdigit():
+                continue
+            port = int(p)
+        host = host.lstrip('.')
+        if host and not host.isascii():  # compared with the browser's punycode form
+            try:
+                host = host.encode('idna').decode('ascii')
+            except UnicodeError:
+                continue
+        if host:
+            out.append((host, port))
+    return out
+
+
 def _agent_env_var_hosts():
     """Hosts on which CDPILOT_VAR_<NAME> values may be typed (CDPILOT_VAR_HOSTS,
-    comma-separated; a listed host covers its subdomains). Empty = never: a
-    flow a prompt-injected model records on another site must not be able to
-    draw on the environment's secrets (2026-11-10 review)."""
-    return [h.strip().lower() for h in os.environ.get(AGENT_VAR_HOSTS_ENV, '').split(',') if h.strip()]
+    comma-separated; a listed host covers its subdomains; the port of a
+    `host:port` entry is checked against the live page, see _var_url_allowed).
+    Empty = never: a flow a prompt-injected model records on another site must
+    not be able to draw on the environment's secrets (2026-11-10 review)."""
+    return [h for h, _p in _var_host_entries()]
 
 
 def _agent_host_allowed(host, allowed):
@@ -16373,6 +16683,244 @@ def _agent_host_allowed(host, allowed):
     return bool(host) and any(host == a or host.endswith('.' + a.lstrip('.')) for a in allowed)
 
 
+_VAR_LOOPBACK_HOSTS = frozenset({'localhost', '127.0.0.1', '::1'})
+
+
+def _var_url_allowed(url, entries, subject='the active page'):
+    """None when an environment value may be typed on the page at `url`, else why
+    (names only, never a value). https on a host the entries name; http only on
+    a loopback host (localhost, 127.0.0.1, [::1], *.localhost); the scheme's
+    default port unless the entry is written `host:port` (2026-11-11 review: a
+    host-only check let http://bank.example and bank.example:8443 through).
+    `subject` names the URL in the reason (the active page, a go URL).
+    A URL with a backslash, a control character or whitespace anywhere, or `@`
+    / `%` in its authority, is refused: Python and the browser read such a URL
+    differently (`https://evil.example\\@bank.example/` is bank.example to
+    urlparse, evil.example to Chrome; round-2 review). A non-ASCII host is
+    compared in its IDNA (punycode) form, as the browser reports it."""
+    from urllib.parse import urlparse
+    raw = url or ''
+    if '\\' in raw or any(ord(c) < 0x21 or ord(c) == 0x7f or c.isspace() for c in raw):
+        return (f'{subject} has a backslash, a control character or whitespace '
+                '(the browser and cdpilot could read it as different hosts)')
+    try:
+        u = urlparse(raw)
+        scheme, host, port = (u.scheme or '').lower(), (u.hostname or '').lower(), u.port
+    except ValueError:
+        return f'{subject} has an unreadable URL'
+    if '@' in u.netloc or '%' in u.netloc:
+        return f'{subject} has user info or an escape (@, %) before its path'
+    if host and not host.isascii():
+        try:
+            host = host.encode('idna').decode('ascii')
+        except UnicodeError:
+            return f'{subject} has a host that is not a valid domain name'
+    if not host:
+        if subject == 'the active page':
+            return 'the active page could not be read or has no host (about:blank, data:, browser down)'
+        return f'{subject} has no host'
+    shown = f'[{host}]' if ':' in host else host
+    loopback = host in _VAR_LOOPBACK_HOSTS or host.endswith('.localhost')
+    if scheme != 'https' and not (scheme == 'http' and loopback):
+        return (f'{subject} is {scheme or "?"}://{shown}; an environment value is typed only '
+                'over https (http only on a loopback host)')
+    default = 443 if scheme == 'https' else 80
+    eff = default if port is None else port
+    for h, p in entries:
+        if (host == h or host.endswith('.' + h)) and eff == (default if p is None else p):
+            return None
+    if port is not None and port != default:
+        return (f'{subject} is on {shown}:{port}; {AGENT_VAR_HOSTS_ENV} does not name that '
+                f'port (write the entry as host:{port})')
+    return f'{subject} is on {shown}; {AGENT_VAR_HOSTS_ENV} does not name it'
+
+
+# One Runtime.callFunctionOn on the resolved field, for a step that types a
+# CDPILOT_VAR_<NAME> value (replay) or a flow placeholder (agent run): it
+# checks the page, then the element, then sets the value, so no navigation
+# can come between the check and the typing (2026-11-11 review: TOCTOU,
+# focus moved into an iframe, Input.insertText into whatever had focus).
+# The value is an argument, never part of a script's source text. The page
+# check runs first and uses only what a page cannot replace (location's own
+# fields, ===, string indexing): until it passes the page may be hostile.
+# rule: {kind: fill|select|assert, origin: exact origin or null,
+#        hosts: [[host, port or null], ...] or null (both checked when both set),
+#        noUrlFields: true to refuse input type=search/url,
+#        ce: true to accept a contenteditable element (agent run only: a
+#        replayed flow could read its text back with wait-for-text / text=)}.
+_VAR_TARGET_FN = r"""function (value, rule) {
+  'use strict';
+  /* cdpilot-var-target */
+  var proto = location.protocol, host = location.hostname, port = location.port, i;
+  function tail(h, d) {
+    if (h === d) return true;
+    var n = h.length, m = d.length, k;
+    if (n <= m + 1 || h[n - m - 1] !== '.') return false;
+    for (k = 0; k < m; k++) if (h[n - m + k] !== d[k]) return false;
+    return true;
+  }
+  if (host.length > 1 && host[0] === '[') {
+    var bare = '';
+    for (i = 1; i < host.length - 1; i++) bare += host[i];
+    host = bare;
+  }
+  var hasOrigin = rule.origin !== null && rule.origin !== undefined;
+  if (!hasOrigin && (rule.hosts === null || rule.hosts === undefined))
+    return {refused: 'no page rule'};  // fail closed
+  if (hasOrigin && location.origin !== rule.origin)
+    return {refused: 'the page is ' + location.origin + ', not ' + rule.origin};
+  if (rule.hosts !== null && rule.hosts !== undefined) {
+    var loop = host === 'localhost' || host === '127.0.0.1' || host === '::1' || tail(host, 'localhost');
+    if (!(proto === 'https:' || (proto === 'http:' && loop)))
+      return {refused: 'the page is ' + proto + '//' + host +
+        '; an environment value is typed only over https (http only on a loopback host)'};
+    var dflt = proto === 'https:' ? '443' : '80', eff = port === '' ? dflt : port, ok = false;
+    var hosts = rule.hosts || [];
+    for (i = 0; i < hosts.length && !ok; i++) {
+      var ep = hosts[i][1] === null ? dflt : '' + hosts[i][1];
+      if (tail(host, hosts[i][0]) && eff === ep) ok = true;
+    }
+    if (!ok) return {refused: 'the page is on ' + host + (port ? ':' + port : '') +
+      ', not a host the step may type on'};
+  }
+  var el = this, kind = rule.kind;
+  if (window.top !== window || el.ownerDocument !== document)
+    return {refused: 'the field is not in the top-level page'};
+  var tag = el.tagName, type = tag === 'INPUT' ? el.type : '';
+  if (tag === 'IFRAME' || tag === 'FRAME' || tag === 'OBJECT' || tag === 'EMBED')
+    return {refused: 'the target is an ' + tag + ', not a field'};
+  // search and url fields put what they hold into a URL (rule.noUrlFields: replay and
+  // environment values; round-2 review)
+  var textLike = tag === 'INPUT' && (type === 'text' || type === 'password' || type === 'email' ||
+    type === 'tel' || type === 'number' || (rule.noUrlFields !== true && (type === 'url' || type === 'search')));
+  var what = tag === 'INPUT' ? 'an input of type ' + type : 'a ' + tag;
+  if (kind === 'select') {
+    if (tag !== 'SELECT') return {refused: 'the target is ' + what + ', not a <select>'};
+  } else if (kind === 'assert') {
+    if (!textLike && tag !== 'TEXTAREA' && tag !== 'SELECT')
+      return {refused: 'the target is ' + what + ', not a field'};
+    return {ok: true, tag: tag, equal: el.value === value};
+  } else if (!textLike && tag !== 'TEXTAREA' &&
+             !(rule.ce === true && tag !== 'INPUT' && tag !== 'SELECT' && el.isContentEditable)) {
+    return {refused: 'the target is ' + what + ', not an editable field'};
+  }
+  if (typeof el.focus === 'function') el.focus();
+  if (kind === 'select') {
+    var norm = function (s) {
+      return ('' + (s == null ? '' : s)).toLocaleLowerCase().replace(/[\s ]+/g, ' ').trim();
+    };
+    var want = norm(value), opts = el.options, pick = null;
+    for (i = 0; i < opts.length && !pick; i++) if (norm(opts[i].text) === want) pick = opts[i];
+    for (i = 0; i < opts.length && !pick; i++) if (norm(opts[i].text).indexOf(want) !== -1) pick = opts[i];
+    if (!pick) return {missing: 'no option of the <select> matches'};
+    el.value = pick.value;
+    el.dispatchEvent(new Event('change', {bubbles: true}));
+    return {ok: true, tag: tag};
+  }
+  if (tag === 'INPUT' || tag === 'TEXTAREA') {
+    var d = Object.getOwnPropertyDescriptor(
+      tag === 'INPUT' ? HTMLInputElement.prototype : HTMLTextAreaElement.prototype, 'value');
+    if (d && d.set) d.set.call(el, value); else el.value = value;
+  } else {
+    el.textContent = value;
+  }
+  el.dispatchEvent(new Event('input', {bubbles: true}));
+  el.dispatchEvent(new Event('change', {bubbles: true}));
+  return {ok: true, tag: tag};
+}"""
+_VAR_TARGET_GROUP = 'cdpilot-var-group'
+
+
+async def _var_target_call(ws_url, object_id, value, rule):
+    """Run _VAR_TARGET_FN on `object_id`; its verdict dict. Anything else (the
+    page navigated, the object is gone, no reply) is a refusal."""
+    r = await cdp_send(ws_url, [(1, 'Runtime.callFunctionOn', {
+        'objectId': object_id, 'functionDeclaration': _VAR_TARGET_FN,
+        'arguments': [{'value': value}, {'value': rule}], 'returnByValue': True})])
+    out = r.get(1, {}).get('result', {}).get('value')
+    if isinstance(out, dict) and (out.get('ok') or out.get('refused') or out.get('missing')):
+        return out
+    return {'refused': 'the page did not confirm the field (it may have navigated)'}
+
+
+REPLAY_STRICT_ENV = 'CDPILOT_REPLAY_STRICT_TARGET'
+REPLAY_ALLOWED_HOSTS_ENV = 'CDPILOT_REPLAY_ALLOWED_HOSTS'
+REPLAY_ORIGIN_ENV = 'CDPILOT_REPLAY_ORIGIN'  # the exact origin replay read before the step
+# An environment value reaches the child in its environment, never in argv
+# (2026-11-11 review: argv is readable by every local user): argv carries
+# @@cdpilot-value-<run token>-<slot>@@, the child reads REPLAY_VALUE_ENV<slot>
+# and REPLAY_TOKEN_ENV once at start (and drops them from its environment, so
+# nothing it starts inherits them) and swaps the value in right before the
+# checked call. The token is random per replay run: a flow file cannot write a
+# sentinel that matches, and a sentinel without its value fails closed.
+REPLAY_VALUE_ENV = 'CDPILOT_REPLAY_VALUE_'
+REPLAY_TOKEN_ENV = 'CDPILOT_REPLAY_TOKEN'
+_REPLAY_SENTINEL_RE = _re.compile(r'@@cdpilot-value-([0-9a-f]+)-(\d+)@@')
+_REPLAY_VALUES = {}  # this process's REPLAY_VALUE_ENV* / REPLAY_TOKEN_ENV, taken at start
+
+
+def _replay_take_values():
+    """Move REPLAY_VALUE_ENV* and REPLAY_TOKEN_ENV out of os.environ (CLI start)."""
+    _REPLAY_VALUES.clear()
+    for k in [k for k in os.environ if k.startswith(REPLAY_VALUE_ENV) or k == REPLAY_TOKEN_ENV]:
+        _REPLAY_VALUES[k] = os.environ.pop(k)
+
+
+def _replay_strict_value(cmd, value):
+    """`value` with each replay sentinel swapped for its environment value;
+    exit 2 for a sentinel whose token or value is missing (no value printed)."""
+    tok = _REPLAY_VALUES.get(REPLAY_TOKEN_ENV, '')
+
+    def put(m):
+        v = _REPLAY_VALUES.get(REPLAY_VALUE_ENV + m.group(2))
+        if not tok or not secrets.compare_digest(m.group(1), tok) or v is None:
+            _replay_strict_refuse(cmd, 'a replay value placeholder has no value (sentinel without its value)')
+        return v
+    return _REPLAY_SENTINEL_RE.sub(put, value)
+
+
+def _replay_strict_rule():
+    """The page rule for a step `replay` runs with a CDPILOT_VAR_<NAME> value
+    (it sets REPLAY_STRICT_ENV and REPLAY_ALLOWED_HOSTS_ENV for that child
+    only), or None. fill/type/smart-fill/smart-select/assert-value then act
+    only through _VAR_TARGET_FN: top-level page, an editable field, the host
+    rule checked in the same call that types."""
+    if os.environ.get(REPLAY_STRICT_ENV) != '1':
+        return None
+    hosts = _var_host_entries(os.environ.get(REPLAY_ALLOWED_HOSTS_ENV, ''))
+    return {'origin': os.environ.get(REPLAY_ORIGIN_ENV) or None, 'hosts': [[h, p] for h, p in hosts],
+            'ce': False, 'noUrlFields': True}
+
+
+def _replay_strict_refuse(cmd, why):
+    """Exit 2: a replayed step with an environment value may not act (no value printed)."""
+    print(f"Error: {cmd} refused (environment value): {why}", file=sys.stderr)
+    sys.exit(2)
+
+
+async def _replay_strict_act(ws_url, find_js, value, rule, kind):
+    """Find the field with `find_js` (its result is the element; the value is
+    not in it), then check and act in one _VAR_TARGET_FN call. Returns the
+    verdict, or {'missing': <find_js's string result>} when nothing matched."""
+    global _WS_POOL_ENABLED
+    was, _WS_POOL_ENABLED = _WS_POOL_ENABLED, True  # an objectId lives in one CDP session
+    try:
+        r = await cdp_send(ws_url, [(1, 'Runtime.evaluate', {
+            'expression': find_js, 'awaitPromise': True, 'returnByValue': False,
+            'objectGroup': _VAR_TARGET_GROUP})])
+        found = r.get(1, {}).get('result', {})
+        oid = found.get('objectId') if found.get('subtype') not in ('null', 'error') else None
+        if not oid:
+            return {'missing': found.get('value') if isinstance(found.get('value'), str) else ''}
+        return await _var_target_call(ws_url, oid, value, dict(rule, kind=kind))
+    finally:
+        try:
+            await cdp_send(ws_url, [(2, 'Runtime.releaseObjectGroup', {'objectGroup': _VAR_TARGET_GROUP})])
+        except Exception:
+            pass
+        _WS_POOL_ENABLED = was
+
+
 def _agent_trail_push(state, entry):
     trail = state.setdefault('trail', [])
     trail.append(entry)
@@ -16650,8 +17198,26 @@ async def cmd_agent_run(name, var_values=None, dry_run=False):
                 drift(step, f"a placeholder value is typed only where it was recorded "
                             f"({recorded or 'no recorded host'}); this page is {here or 'an opaque origin'}",
                       page, out_actions, text, state, _agent_injection_scan(last_nodes))
+            if step['n'] in env_by_step:  # an environment value: https on a listed host, as replay
+                why = _var_url_allowed(page.get('url', ''), _var_host_entries())
+                if why:
+                    print(json.dumps({'error': f"step {step['n']}: environment value refused: {why}",
+                                      'flow': slug, 'step': step['n']}), file=sys.stderr)
+                    sys.exit(2)
         text_in = subst(step['text'], step['n']) if step.get('text') is not None else None
-        await _agent_perform(match['ref'], step.get('action', 'click'), text_in, amap)
+        if (step.get('text') and _AGENT_VAR_RE.search(step['text'])
+                and step.get('action', 'click') in ('type', 'fill')):
+            # The value is set on the resolved node in one call that checks the
+            # node and its page first (_VAR_TARGET_FN): no focus + insertText,
+            # which typed into whatever had focus (2026-11-11 review).
+            why = await _agent_type_placeholder(match['ref'], text_in, _agent_origin(page.get('url', '')), amap,
+                                                from_env=step['n'] in env_by_step)
+            if why:
+                print(json.dumps({'error': f"step {step['n']}: placeholder value refused: {why}",
+                                  'flow': slug, 'step': step['n']}), file=sys.stderr)
+                sys.exit(2)
+        else:
+            await _agent_perform(match['ref'], step.get('action', 'click'), text_in, amap)
         page2, actions2, out2, text2, state = await snapshot()
         _agent_trail_push(state, {'kind': 'act', 'action': step.get('action', 'click'), 'anchor': anchor,
                                   **({'text': step['text']} if step.get('text') is not None else {}),
@@ -18815,7 +19381,7 @@ class MCPServer:
              "inputSchema": {"type": "object", "properties": {}}},
             {"name": "browser_eval", "description": "Execute arbitrary JavaScript code in the browser page context and return the result. Use for custom DOM queries, data extraction, or page manipulation that other tools don't cover. Expression is evaluated via Runtime.evaluate.",
              "inputSchema": {"type": "object", "properties": {"expression": {"type": "string", "description": "JavaScript expression to evaluate (e.g. 'document.title', 'document.querySelectorAll(\"a\").length')"}}, "required": ["expression"]}},
-            {"name": "browser_eval_batch", "description": "Evaluate N JavaScript expressions in a SINGLE round-trip. Returns an array of {ok, value} or {ok:false, error} objects, one per expression — a failure in one does not abort the batch. Use this when you need many small observations (read 10 DOM values, query multiple selectors, build a report) — collapses N×roundtrip into 1×roundtrip, typically 5-30x faster than calling browser_eval repeatedly.",
+            {"name": "browser_eval_batch", "description": "Evaluate N JavaScript expressions in a SINGLE round-trip. Returns an array of {ok, value} or {ok:false, error} objects, one per expression — a failure in one does not abort the batch. Use this when you need many small observations (read 10 DOM values, query multiple selectors, build a report) — run N JS expressions in one process and one CDP roundtrip instead of N.",
              "inputSchema": {"type": "object", "properties": {"expressions": {"type": "array", "items": {"type": "string"}, "description": "Array of JavaScript expression strings. Each runs in its own try/catch."}}, "required": ["expressions"]}},
             {"name": "browser_tabs", "description": "List all open browser tabs with their IDs, URLs, and titles. Use this to see what pages are open and get tab IDs for switching between them with other navigation commands.",
              "inputSchema": {"type": "object", "properties": {}}},
@@ -21830,7 +22396,10 @@ def cmd_log(*args):
 
 # ─── Record & Replay (issue #5) ───
 
-RECORD_INPUT_CMDS = frozenset({'fill', 'type', 'smart-fill', 'smart-select', 'select', 'assert-value'})
+# The commands whose argument is a typed value (record masks it; replay lets a
+# CDPILOT_VAR_<NAME> value fill it). Real dispatcher commands only: `select`
+# was listed here but is no command (2026-11-11 review).
+RECORD_INPUT_CMDS = frozenset({'fill', 'type', 'smart-fill', 'smart-select', 'assert-value'})
 # Recorder-only widening of the session log's secret-name test, applied to the
 # selector / label of input commands: short words get boundaries so that
 # "#shipping-address" (pin), "#discard" (card) and "#lesson" (ssn) stay verbatim.
@@ -22101,7 +22670,7 @@ def _record_detect_placeholders(cmd, args, step_num=1, vars_dict=None):
                         else:
                             new_args.append(a)
                     return new_args, vars_dict
-        elif cmd in ('smart-fill', 'smart-select', 'select', 'assert-value'):
+        elif cmd in ('smart-fill', 'smart-select', 'assert-value'):
             if len(args) >= 2:
                 sel = args[0]
                 val_str = " ".join(args[1:])
@@ -22461,6 +23030,265 @@ def cmd_record_dispatch(args):
         sys.exit(1)
 
 
+_REPLAY_VAR_RE = _re.compile(r"\{\{([A-Za-z0-9_-]+)\}\}")
+
+
+# Options of the input commands whose value is the next token: the global
+# --timeout, --frame (frame-aware commands), --entropy / --ladder written with
+# a space. A bare --flag the command does not know is read the same way, so a
+# placeholder right after it is never taken for the typed value; only
+# --no-heal stands alone (2026-11-11 review: `fill "#pw" --timeout "{{PW}}"`
+# counted the timeout's value as the typed one).
+_REPLAY_BOOL_FLAGS = frozenset({'--no-heal'})
+
+
+def _replay_option_values(args):
+    """Indexes of `args` that are the value of an option (`--opt <v>`)."""
+    out, i = set(), 0
+    while i < len(args):
+        a = str(args[i])
+        if a.startswith('--') and '=' not in a and a not in _REPLAY_BOOL_FLAGS:
+            if i + 1 < len(args):
+                out.add(i + 1)
+            i += 2
+            continue
+        i += 1
+    return frozenset(out)
+
+
+def _replay_value_positions(cmd, args):
+    """Indexes of `args` that carry the typed value of an input step, by the
+    layout the recorder writes (_record_redact_args) and the dispatcher reads,
+    after the options and their values are set aside (_replay_option_values):
+      fill / type / smart-fill / smart-select
+                             <selector|label> <value...>: every positional
+                             token after the first;
+      assert-value           <selector> <value>: the second only.
+    A token starting with -- or following a bare --option is never a value
+    position. The positions are a subset of the child's, so a selector or a
+    label is never taken for a value. Every other command (go, eval, run,
+    network…): none, so a CDPILOT_VAR_<NAME> environment value never fills it."""
+    if cmd not in RECORD_INPUT_CMDS:
+        return frozenset()
+    opt_vals = _replay_option_values(args)
+    pos = [i for i, a in enumerate(args) if not str(a).startswith('--') and i not in opt_vals]
+    if cmd == 'assert-value':
+        return frozenset(pos[1:2])
+    return frozenset(pos[1:])
+
+
+def _replay_entropy_asked(args):
+    """True when a step (or CDPILOT_ENTROPY) asks for humanized typing."""
+    if any(str(a) == '--entropy' or (str(a).startswith('--entropy=') and str(a) != '--entropy=off')
+           for a in args):
+        return True
+    return os.environ.get('CDPILOT_ENTROPY', '').lower() in ('1', 'true', 'yes', 'on')
+
+
+def _replay_env_refusal(cmd, j, value_idxs, args, env_hosts):
+    """Why a CDPILOT_VAR_<NAME> value may not fill a placeholder in args[j] of a
+    `cmd` step, or None when it may (subject to the flow rule, _replay_env_flow_refusal,
+    and the live page check before the step). Names only: the value itself is
+    never part of the reason."""
+    if cmd in ('go', 'open', 'new-tab'):
+        return 'an environment value never fills a URL; pass --var'
+    if cmd in SLOG_JS_CMDS or cmd == 'eval-batch':
+        return 'an environment value never fills a script; pass --var'
+    if cmd not in RECORD_INPUT_CMDS:
+        return ('an environment value fills only the value of an input step ('
+                + ', '.join(sorted(RECORD_INPUT_CMDS)) + '); pass --var')
+    if str(args[j]).startswith('--'):
+        return 'an environment value never fills a flag; pass --var'
+    if j in _replay_option_values(args):
+        return f'an environment value never fills the value of an option ({args[j - 1]}); pass --var'
+    # A frame-routed step (`sel >>> inner`, --frame) types into an iframe whose
+    # origin the live-host check (top-level page) does not see.
+    if any(FRAME_SEP in str(a) for a in args) or any(
+            str(a) == '--frame' or str(a).startswith('--frame=') for a in args):
+        return 'an environment value never fills a step routed into a frame; pass --var'
+    # Humanized typing sends keys one by one for seconds; the keys follow focus
+    # (into an iframe, onto the next page after a redirect).
+    if _replay_entropy_asked(args):
+        return ('an environment value is never typed with humanized input (--entropy=on, '
+                'CDPILOT_ENTROPY=on); drop it for this step or pass --var')
+    if j not in value_idxs:
+        return 'an environment value never fills a selector or label; pass --var'
+    if not env_hosts:
+        return (f'{AGENT_VAR_HOSTS_ENV} is empty; name the host(s) the value may be '
+                'typed on, or pass --var')
+    return None
+
+
+# The commands a flow may use at all when one of its steps takes a
+# CDPILOT_VAR_<NAME> value (2026-11-11 review: the check covered the typing
+# step only, so `eval` after `fill #password {{PASSWORD}}` read the field and
+# sent it anywhere, or a listener installed before it did). Each runs no
+# script the flow supplies, reads no page data back to the flow, and changes no
+# cdpilot, browser or network setting; replay withholds a child's stdout in
+# such a flow. They still act on the page as a user would: a click follows a
+# link, submit sends a form, and the page's own scripts run, may set cookies or
+# start a download (round-2 review: the old wording claimed no file or cookie
+# is ever written). Left out, among
+# others: eval, multi-eval, eval-batch, batch, run, frame, tools, agent
+# (scripts or other commands); content, html, extract, a11y*, observe,
+# describe, shot*, pdf, console, network, perf, storage, cookies (page data,
+# files); assert, assert-url, assert-title, assert-attr, check (echo actual
+# page values); intercept, proxy, block, dialog, download, upload, permission,
+# geo, throttle, emulate (browser or network settings, local files); new-tab,
+# close-tab, switch-tab, tabs (which page the next step acts on); drag,
+# rightclick, press-hold (text drag, context menu); captcha*, friction.
+REPLAY_ENV_FLOW_CMDS = frozenset({
+    'go', 'open',                                       # http(s) URLs only
+    'click', 'dblclick', 'hover', 'smart-click', 'submit', 'scroll-to', 'dismiss',
+    'keys',                                             # no Ctrl/Alt/Meta combination
+    'fill', 'type', 'smart-fill', 'smart-select',
+    'wait', 'wait-for', 'wait-for-text',
+    'assert-count', 'assert-visible', 'assert-hidden',
+})
+
+
+def _replay_child_args(args):
+    """`args` as the child's dispatcher sees them after the global --timeout."""
+    out, i = [], 0
+    while i < len(args):
+        a = str(args[i])
+        if a == '--timeout':
+            i += 2
+            continue
+        if not a.startswith('--timeout='):
+            out.append(a)
+        i += 1
+    return out
+
+
+# Selector pieces that react to a typed value (2026-11-11 review, H2): an
+# attribute selector on `value` (React copies the property to the attribute),
+# XPath @value, the selector ladder's `value=<text>` form, and pseudo-classes
+# that change with the value. A step that waits on or clicks such a selector,
+# then a navigation, would let a server time the value out character by
+# character. Matched after CSS escapes are decoded (`[v\61 lue` is `[value`).
+_REPLAY_VALUE_PROBE_RE = _re.compile(
+    r"\[\s*(?:[\w*-]*\|)?\s*value\b|@\s*value\b|^\s*value\s*=|"
+    r":(?:-[a-z]+-)?(?:placeholder-shown|valid|invalid|in-range|out-of-range|user-valid|user-invalid|blank"
+    r"|checked|default|indeterminate|autofill)\b",
+    _re.I)
+# CSS comments split a selector anywhere (`[/**/value`); an unclosed one runs to the end.
+_CSS_COMMENT_RE = _re.compile(r"/\*.*?(?:\*/|$)", _re.S)
+
+
+def _replay_value_probe(a):
+    """True when selector text `a` could react to a typed value: an XPath (the
+    ladder evaluates a selector starting with / or .// as one; `(`, ../ and
+    xpath= forms too) or a _REPLAY_VALUE_PROBE_RE piece, read raw, without CSS
+    comments, CSS-unescaped, and once more without comments (round-2 review)."""
+    bare = _CSS_COMMENT_RE.sub('', a)
+    unesc = _css_unescape(bare)
+    return any(_REPLAY_VALUE_PROBE_RE.search(t)
+               or t.lstrip().lower().startswith(('/', './', '../', '(', 'xpath='))
+               for t in (a, bare, unesc, _CSS_COMMENT_RE.sub('', unesc)))
+
+
+def _css_unescape(s):
+    """`s` with CSS escapes decoded (\\76 alue -> value); a bad code point is U+FFFD."""
+    def rep(m):
+        if m.group(1):
+            try:
+                return chr(int(m.group(1), 16))
+            except (ValueError, OverflowError):
+                return '\ufffd'
+        return m.group(2)
+    return _re.sub(r'\\(?:([0-9a-fA-F]{1,6})\s?|(.))', rep, s, flags=_re.S)
+
+
+def _replay_env_flow_refusal(idx, cmd, args, env_steps, fill_cli):
+    """Why step `idx` may not run in a flow that types an environment value
+    (env_steps: the indexes of the steps that take one), or None. `fill_cli`
+    puts the --var values in (a go URL or a selector may carry one)."""
+    if cmd == 'assert-value' and idx in env_steps:
+        return None  # compared inside the page, nothing printed (_replay_strict_rule)
+    if cmd not in REPLAY_ENV_FLOW_CMDS:
+        if cmd == 'assert-value':
+            return ("assert-value prints the field's actual value unless the step itself "
+                    "takes the environment value")
+        return (f'{cmd} is not one of the commands such a flow may use ('
+                + ', '.join(sorted(REPLAY_ENV_FLOW_CMDS)) + ')')
+    rest = _replay_child_args(args)
+    if cmd in ('go', 'open'):
+        # Every page such a flow opens is one an environment value may be typed
+        # on (https, a listed host and port): no step can navigate the tab to a
+        # server that would time or read what the flow does (H2).
+        why = _var_url_allowed(fill_cli(rest[0]) if rest else '', _var_host_entries(), f'the {cmd} URL')
+        if why:
+            return f'{cmd} opens a page an environment value may not be typed on: {why}'
+        return None
+    typed = _replay_value_positions(cmd, args)
+    for j, a in enumerate(args):
+        if j in typed:
+            continue  # typed text, not a selector
+        if _replay_value_probe(fill_cli(str(a))):
+            return (f'{cmd} names an XPath or a selector that reacts to a typed value ([value...], '
+                    '@value, value=, :placeholder-shown, :valid, :checked...); a page could time the '
+                    'value out')
+    if cmd == 'keys' and rest:
+        if set(rest[0].lower().split('+')) & {'ctrl', 'control', 'alt', 'meta'}:
+            return 'keys takes no Ctrl/Alt/Meta combination here (copy and paste carry a typed value)'
+    return None
+
+
+def _replay_scrub(text, values):
+    """`text` with every form of each value replaced by {{name}}: the value, its
+    repr (with and without quotes), its JSON-escaped and URL-encoded forms
+    (2026-11-11 review: a child that echoed repr(value) got past an exact-match
+    scrub). One pass, longest form first; empty values are skipped."""
+    if not text:
+        return text
+    from urllib.parse import quote, quote_plus
+    names = {}
+    for name, v in values.items():
+        v = str(v)
+        if not v:
+            continue
+        r, j = repr(v), json.dumps(v)
+        for f in (v, r, r[1:-1], ascii(v)[1:-1], j, j[1:-1], json.dumps(v, ensure_ascii=False)[1:-1],
+                  quote(v, safe=''), quote(v), quote_plus(v)):
+            if f:
+                names.setdefault(f, name)
+    if not names:
+        return text
+    pat = _re.compile('|'.join(_re.escape(f) for f in sorted(names, key=len, reverse=True)))
+    return pat.sub(lambda m: '{{' + names[m.group(0)] + '}}', text)
+
+
+def _replay_live_url():
+    """URL of the page the next replay step acts on, read now from the CDP
+    target list (no cache): the target get_page_ws() picks for a child command
+    (CDPILOT_TARGET pin, then the session tab). '' when the browser does not
+    answer. A navigation between this read and the child's own call is caught
+    there: a step with an environment value checks the page again in the same
+    call that types (_VAR_TARGET_FN)."""
+    cdp_cache_invalidate()
+    if cdp_get("/json", no_cache=True) is None:
+        return ''
+    try:
+        with contextlib.redirect_stdout(io.StringIO()):
+            _ws, page = get_page_ws()
+    except SystemExit:
+        return ''
+    cdp_cache_invalidate()
+    url = (page or {}).get("url", "")
+    for t in cdp_get("/json", no_cache=True) or []:
+        if t.get("id") and t.get("id") == (page or {}).get("id"):
+            url = t.get("url", "")
+            break
+    return url or ''
+
+
+def _replay_live_host():
+    """Host of _replay_live_url() ('' for none)."""
+    url = _replay_live_url()
+    return _agent_host_path(url)[0] if url else ''
+
+
 def cmd_replay(*args):
     """Replay a recorded flow JSON file."""
     if not args:
@@ -22585,40 +23413,98 @@ def cmd_replay(*args):
             print(f"cdpilot: invalid flow file: step {idx} malformed", file=sys.stderr)
             sys.exit(2)
 
-    collected_vars = {}
+    # Values: --var (the caller holds them) fills any placeholder, as before.
+    # CDPILOT_VAR_<NAME> fills only the value of an input step, and only on a
+    # host named in CDPILOT_VAR_HOSTS, checked live right before that step
+    # (2026-11-10 review: a crafted flow file could send an environment secret
+    # to any host through go / eval / a fill after `go https://evil`).
+    # The two sources stay in separate dicts; nothing here prints a value.
+    env_vars = {}
     for env_k, env_v in os.environ.items():
-        if env_k.startswith("CDPILOT_VAR_"):
-            var_name = env_k[len("CDPILOT_VAR_"):].lower()
-            collected_vars[var_name] = env_v
-            collected_vars[env_k[len("CDPILOT_VAR_"):]] = env_v
-
-    collected_vars.update(cli_vars)
-
-    needed_vars = set(data.get("vars", {}).keys())
-    for s in steps:
-        if isinstance(s, dict):
-            for a in s.get("args", []):
-                for m in _re.finditer(r"\{\{([A-Za-z0-9_-]+)\}\}", str(a)):
-                    needed_vars.add(m.group(1))
-
-    def get_var_value(name):
-        if name in collected_vars:
-            return collected_vars[name]
-        if name.lower() in collected_vars:
-            return collected_vars[name.lower()]
-        if name.upper() in collected_vars:
-            return collected_vars[name.upper()]
+        if env_k.startswith("CDPILOT_VAR_") and env_k != AGENT_VAR_HOSTS_ENV:
+            env_vars[env_k[len("CDPILOT_VAR_"):]] = env_v
+            env_vars.setdefault(env_k[len("CDPILOT_VAR_"):].lower(), env_v)
+
+    def _lookup(src, name):
+        for k in (name, name.lower(), name.upper()):
+            if k in src:
+                return src[k]
         return None
 
-    missing = []
-    for var_name in sorted(needed_vars):
-        if get_var_value(var_name) is None:
-            missing.append(var_name)
+    env_hosts = _agent_env_var_hosts()
+    # Settled statically, before any step runs (exit 2 otherwise):
+    # env_by_step: step index -> {arg index -> names the environment may fill there}
+    env_by_step, missing, refused = {}, [], []
+    needed_vars = set((data.get("vars") or {}).keys())
+    for idx, s in enumerate(steps, 1):
+        cmd = s.get("cmd", "")
+        value_idxs = _replay_value_positions(cmd, s.get("args", []))
+        for j, a in enumerate(s.get("args", [])):
+            for m in _REPLAY_VAR_RE.finditer(str(a)):
+                k = m.group(1)
+                needed_vars.add(k)
+                if _lookup(cli_vars, k) is not None:
+                    continue
+                if _lookup(env_vars, k) is None:
+                    if k not in missing:
+                        missing.append(k)
+                    continue
+                why = _replay_env_refusal(cmd, j, value_idxs, s.get("args", []), env_hosts)
+                if why:
+                    refused.append({"var": k, "step": idx, "cmd": cmd, "why": why})
+                else:
+                    env_by_step.setdefault(idx, {}).setdefault(j, set()).add(k)
+    for k in sorted(needed_vars):  # catalogued but used in no step: a value must still exist
+        if k not in missing and _lookup(cli_vars, k) is None and _lookup(env_vars, k) is None:
+            missing.append(k)
 
-    if missing:
-        print(f"cdpilot: missing required variable(s): {', '.join(missing)}", file=sys.stderr)
+    hint = (f"--var name=value, or CDPILOT_VAR_<NAME> with {AGENT_VAR_HOSTS_ENV}=<host,...> "
+            "for the value of an input step (" + ", ".join(sorted(RECORD_INPUT_CMDS)) + ") "
+            "in a flow made only of: " + ", ".join(sorted(REPLAY_ENV_FLOW_CMDS)))
+    if missing or refused:
+        parts = []
+        if missing:
+            parts.append(f"missing required variable(s): {', '.join(sorted(set(missing)))}")
+        if refused:
+            parts.append("environment value(s) refused: "
+                         + ", ".join(sorted({r['var'] for r in refused})))
+        err = {"error": "; ".join(parts), "missing": sorted(set(missing)), "hint": hint}
+        if refused:
+            err["refused"] = refused
+        print(json.dumps(err), file=sys.stderr)
         sys.exit(2)
 
+    def _fill_cli(s):
+        return _REPLAY_VAR_RE.sub(lambda m: str(_lookup(cli_vars, m.group(1)))
+                                  if _lookup(cli_vars, m.group(1)) is not None else m.group(0), s)
+
+    # A flow that types an environment value runs only steps that cannot read
+    # the page or move the value elsewhere (REPLAY_ENV_FLOW_CMDS), settled
+    # before the first step, --dry-run and --continue alike.
+    if env_by_step:
+        env_names = sorted({k for js in env_by_step.values() for ks in js.values() for k in ks})
+        for idx, s in enumerate(steps, 1):
+            why = _replay_env_flow_refusal(idx, s["cmd"], s["args"], env_by_step, _fill_cli)
+            if why:
+                why = (f"step {idx} ({s['cmd']}) may not run in a flow that types an environment "
+                       f"value: {why}; pass --var, or split the flow")
+                print(json.dumps({"error": "environment value(s) refused: " + ", ".join(env_names)
+                                           + f"; step {idx} ({s['cmd']}) may not run in this flow",
+                                  "missing": [],
+                                  "refused": [{"var": k, "step": idx, "cmd": s["cmd"], "why": why}
+                                              for k in env_names],
+                                  "hint": hint}), file=sys.stderr)
+                sys.exit(2)
+
+    # Every value the flow can put in a step, scrubbed from any output it prints.
+    flow_values = {}
+    for k in sorted(needed_vars):
+        if _lookup(cli_vars, k) is not None:
+            flow_values[k] = _lookup(cli_vars, k)
+        elif any(k in ks for js in env_by_step.values() for ks in js.values()):
+            flow_values[k] = _lookup(env_vars, k)
+    env_flow = bool(env_by_step)
+
     total_steps = len(steps)
     if dry_run:
         for idx, step in enumerate(steps, 1):
@@ -22630,6 +23516,18 @@ def cmd_replay(*args):
         sys.exit(0)
 
     had_failure = False
+    typed_at = 0  # the last step that took an environment value (0: none yet)
+    pinned = ''  # the exact origin the first environment value was typed on
+    run_token = secrets.token_hex(16)  # per run: a flow file cannot write a matching sentinel
+
+    def _page_why(url):
+        """Why an environment value may not be near the page at `url`, or None:
+        the host rule, and once a value is typed, that page's exact origin."""
+        why = _var_url_allowed(url, _var_host_entries())
+        if why is None and pinned and _agent_origin(url) != pinned:
+            why = (f"the active page is {_agent_origin(url) or 'an opaque origin'}, not {pinned} "
+                   "where the environment value was typed")
+        return why
     for idx, step in enumerate(steps, 1):
         if idx > 1:
             if delay_mode == "real":
@@ -22645,32 +23543,6 @@ def cmd_replay(*args):
 
         cmd = step.get("cmd", "")
         raw_args = step.get("args", [])
-        sub_args = []
-        for a in raw_args:
-            s_val = str(a)
-            sub = _re.sub(r"\{\{([A-Za-z0-9_-]+)\}\}",
-                          lambda m: str(get_var_value(m.group(1)) if get_var_value(m.group(1)) is not None else m.group(0)),
-                          s_val)
-            sub_args.append(sub)
-
-        # Collect substituted variable values for placeholders in this step
-        step_subs = {}
-        for a in raw_args:
-            for m in _re.finditer(r"\{\{([A-Za-z0-9_-]+)\}\}", str(a)):
-                vname = m.group(1)
-                vval = get_var_value(vname)
-                if vval is not None and str(vval) != "":
-                    step_subs[vname] = str(vval)
-
-        def sanitize_output(text):
-            if not text:
-                return text
-            # Replace longest value first; skip empty values
-            sorted_subs = sorted(step_subs.items(), key=lambda kv: len(kv[1]), reverse=True)
-            for vname, vval in sorted_subs:
-                if vval:
-                    text = text.replace(vval, f"{{{{{vname}}}}}")
-            return text
 
         if cmd in RECORD_INPUT_CMDS and raw_args:
             target = next((a for a in raw_args if not a.startswith("--")), raw_args[0])
@@ -22680,9 +23552,73 @@ def cmd_replay(*args):
         else:
             step_label = cmd
 
+        env_here = env_by_step.get(idx, {})  # arg index -> names the environment may fill
+        live = ''
+        if env_here or typed_at:
+            # Checked now (never cached across steps), before a step that types
+            # an environment value and before every step after one: the page
+            # must be https (http on loopback) on a host CDPILOT_VAR_HOSTS
+            # names, on the port the entry allows, and once a value is typed,
+            # on the exact origin it was typed on (round-2 review: a host
+            # suffix let a later step run on another subdomain). The child
+            # checks again in the call that types (REPLAY_STRICT_ENV). A
+            # refusal always stops the replay, --continue or not, and no value
+            # is in any argv.
+            live = _replay_live_url()
+            why = _page_why(live)
+            if why and not env_here:
+                # A click followed a link off that origin after the value was
+                # typed (H2): nothing more runs on that page.
+                print(f"[{idx}/{total_steps}] {step_label} ... refused")
+                print(json.dumps({"error": f"step {idx} ({cmd}) not run: the page left {pinned} "
+                                           f"after step {typed_at} typed an environment value",
+                                  "missing": [], "step": idx, "cmd": cmd, "why": why,
+                                  "hint": "keep every step after the value on the page's origin, "
+                                          "or pass --var name=value"}), file=sys.stderr)
+                sys.exit(2)
+            if why:
+                names = sorted({k for ks in env_here.values() for k in ks})
+                print(f"[{idx}/{total_steps}] {step_label} ... refused")
+                print(json.dumps({"error": "environment value(s) refused: " + ", ".join(names),
+                                  "missing": [],
+                                  "refused": [{"var": k, "step": idx, "cmd": cmd, "why": why} for k in names],
+                                  "hint": f"open an https page on a host named in {AGENT_VAR_HOSTS_ENV} "
+                                          "(host:port for another port) first, or pass --var name=value"}),
+                      file=sys.stderr)
+                sys.exit(2)
+
+        child_values = {}  # REPLAY_VALUE_ENV<slot> -> environment value, for this child only
+
+        def _fill(m, j):
+            k = m.group(1)
+            v = _lookup(cli_vars, k)
+            if v is None and k in env_here.get(j, ()):
+                slot = sorted({n for ns in env_here.values() for n in ns}).index(k)
+                child_values[f"{REPLAY_VALUE_ENV}{slot}"] = str(_lookup(env_vars, k))
+                return f"@@cdpilot-value-{run_token}-{slot}@@"  # the value goes in the child's environment
+            if v is None:
+                return m.group(0)
+            return str(v)
+
+        sub_args = [_REPLAY_VAR_RE.sub(lambda m, j=j: _fill(m, j), str(a)) for j, a in enumerate(raw_args)]
+
         env = os.environ.copy()
         env["CDPILOT_REPLAY_ACTIVE"] = "1"
         env["PYTHONIOENCODING"] = "utf-8"
+        # The strict-target pair is replay's own, set for a step that takes an
+        # environment value and removed for every other (a flow file sets no
+        # environment; an inherited pair never reaches an unrelated step).
+        for k in [k for k in env if k in (REPLAY_STRICT_ENV, REPLAY_ALLOWED_HOSTS_ENV, REPLAY_TOKEN_ENV,
+                                          REPLAY_ORIGIN_ENV) or k.startswith(REPLAY_VALUE_ENV)]:
+            del env[k]
+        if env_here:
+            pinned = pinned or _agent_origin(live)
+            env[REPLAY_STRICT_ENV] = "1"
+            env[REPLAY_ALLOWED_HOSTS_ENV] = os.environ.get(AGENT_VAR_HOSTS_ENV, "")
+            env[REPLAY_ORIGIN_ENV] = pinned  # the child types only on this exact origin
+            env[REPLAY_TOKEN_ENV] = run_token
+            env.update(child_values)
+            typed_at = idx
         t0 = time.monotonic()
         child_cmd = [sys.executable, os.path.abspath(__file__), cmd] + sub_args
         res = subprocess.run(
@@ -22692,16 +23628,42 @@ def cmd_replay(*args):
             errors="replace",
             env=env
         )
-        dur = time.monotonic() - t0
+        # In a flow that types an environment value no step's duration is shown:
+        # a wait that ends early or times out would tell the reader about the
+        # page (round-2 review).
+        dur = "" if env_flow else f" {time.monotonic() - t0:.1f}s"
 
         if res.returncode == 0:
-            print(f"[{idx}/{total_steps}] {step_label} ... ok {dur:.1f}s")
+            print(f"[{idx}/{total_steps}] {step_label} ... ok{dur}")
+            if env_flow and cmd in ("go", "open"):
+                # The page the browser committed, read back: a redirect, or a URL
+                # cdpilot and the browser parse differently, ends here (round-2).
+                why = _page_why(_replay_live_url())
+                if why:
+                    print(json.dumps({"error": f"step {idx} ({cmd}) landed on a page an environment "
+                                               "value may not be typed on; nothing more runs",
+                                      "missing": [], "step": idx, "cmd": cmd, "why": why,
+                                      "hint": f"list the host the page lands on in {AGENT_VAR_HOSTS_ENV}, "
+                                              "or pass --var name=value"}), file=sys.stderr)
+                    sys.exit(2)
+        elif env_here and res.returncode == 2:
+            # The child refused to type the environment value (the page or the
+            # field failed its check): a refusal, so the replay stops with 2.
+            print(f"[{idx}/{total_steps}] {step_label} ... refused (2){dur}")
+            err_msg = _replay_scrub(res.stderr.rstrip(), flow_values)
+            if err_msg:
+                print(err_msg, file=sys.stderr)
+            sys.exit(2)
         else:
-            print(f"[{idx}/{total_steps}] {step_label} ... failed ({res.returncode}) {dur:.1f}s")
-            raw_err = res.stderr.rstrip() if res.stderr else res.stdout.rstrip()
-            err_msg = sanitize_output(raw_err)
+            print(f"[{idx}/{total_steps}] {step_label} ... failed ({res.returncode}){dur}")
+            # In a flow that types an environment value a step's stdout (page
+            # labels, a field's text) is never shown, only its scrubbed stderr.
+            raw_err = res.stderr.rstrip() if res.stderr else ("" if env_flow else res.stdout.rstrip())
+            err_msg = _replay_scrub(raw_err, flow_values)
             if err_msg:
                 print(err_msg, file=sys.stderr)
+            elif env_flow:
+                print("(step output withheld: the flow types an environment value)", file=sys.stderr)
             had_failure = True
             if not continue_on_error:
                 sys.exit(1)
@@ -22713,7 +23675,13 @@ def cmd_replay(*args):
 def cmd_replay_dispatch(args):
     """Dispatch cdpilot replay command."""
     if not args or args[0] in ('--help', '-h', 'help'):
-        print("Usage: cdpilot replay <flow.json> [--var k=v ...] [--delay real|none|<ms>] [--dry-run] [--continue]\n",
+        print("Usage: cdpilot replay <flow.json> [--var k=v ...] [--delay real|none|<ms>] [--dry-run] [--continue]\n"
+              "  --var k=v fills any {{k}}. CDPILOT_VAR_<NAME> fills only the value of an input step\n"
+              "  (" + ", ".join(sorted(RECORD_INPUT_CMDS)) + ") on an https page whose host\n"
+              "  CDPILOT_VAR_HOSTS names (host:port for another port; http only on loopback), checked\n"
+              "  before the step and in the call that types; go/eval and every other command take\n"
+              "  --var only. A flow with such a value may use only: "
+              + ", ".join(sorted(REPLAY_ENV_FLOW_CMDS)) + ".\n",
               file=sys.stderr)
         sys.exit(0 if (args and args[0] in ('--help', '-h', 'help')) else 2)
     cmd_replay(*args)
@@ -22816,6 +23784,18 @@ def _daemon_send(conn, obj):
         pass  # the client went away; the command still runs to its end
 
 
+def _daemon_hangup(conn):
+    """End the conversation for the peer, whatever else still holds the socket.
+    close() alone only drops this process's reference: on Linux a thread blocked
+    in recv() on it (the client watcher, up to its 10 s timeout) keeps the
+    connection open, the client sees no EOF and every warm call took 10 s there
+    (K-0027, CI 42810141487). shutdown() sends the EOF now and wakes that thread."""
+    try:
+        conn.shutdown(socket.SHUT_RDWR)
+    except OSError:
+        pass  # already gone
+
+
 def _daemon_recv_line(conn, limit=8 * 1024 * 1024):
     """One newline-terminated JSON object, or None (closed, too long, invalid)."""
     chunks, size = [], 0
@@ -23188,6 +24168,8 @@ def _daemon_serve_entry(args):
                     stop.append(True)
                 except OSError:
                     pass
+                finally:
+                    _daemon_hangup(conn)
     finally:
         asyncio.run = _DAEMON["asyncio_run"]
         try:
@@ -23208,6 +24190,7 @@ def _cli_main():
     runs it per request with sys.argv, the streams and atexit swapped in.
     Exits by SystemExit like any script; never returns a code."""
     global _FRAME_FLAG
+    _replay_take_values()  # a replayed environment value never stays in os.environ
     # On Windows a pipe (an agent's shell, the MCP server, `> file`) gets the
     # ANSI code page, so a Turkish page title or an emoji crashed the command
     # with UnicodeEncodeError. Write UTF-8 unless the user chose an encoding.