dsh-browser-playwright-codex 0.6.1 → 0.6.6

package/lib/challenge.js

@@ -1,35 +1,211 @@
+import { CAPTCHA_ROLES, CAPTCHA_WORD, CHALLENGE_SIGNATURES, WORDING_COMMAND, WORDING_EXCLUDE, WORDING_TITLE, } from "./challenge-signatures.js";
+/** How many accessible names the wording tiers may look at. */
+const MAX_NAMES = 60;
 /**
- * Detect anti-bot / human-verification challenge pages (Cloudflare
- * interstitial, Turnstile, reCAPTCHA-style) from a snapshot's title, url and
- * visible text. We do NOT try to solve them: the correct move for an agent is
- * to hand the challenge to the human who can see the open window. Returns the
- * engine name when matched, else null. Matching is conservative to avoid
- * false positives on ordinary pages.
+ * The widget tier reads deeper than the wording tiers. Measured 2026-10-17 on
+ * nopecha.com/demo/hcaptcha: a real hCaptcha iframe named
+ * "包含 hCaptcha 安全挑战复选框的小部件" sits below depth 2, so a three-level scan
+ * never saw it and the real widget was reported as NO MATCH. Vendor widgets are
+ * usually mounted inside a wrapper stack; control labels are not.
+ */
+const WIDGET_DEPTH = 8;
+/** Cap on names the widget tier walks (deeper scan, so a larger budget). */
+const MAX_WIDGET_NAMES = 150;
+/** A control label is short; a sentence that merely mentions captchas is not. */
+const MAX_CONTROL_LABEL = 32;
+/**
+ * A title that mentions verification only counts on a page with (almost) nothing
+ * to click. Measured on real pages 2026-10-17: 百度's actual 安全验证 page has
+ * **0** actionable elements, while a Baidu *search result* page titled
+ * "安全验证_百度搜索" has 57 and "滑块验证_百度搜索" has 81. Without this gate the
+ * title tier fires on any search for those words — which is exactly the query a
+ * person investigating captchas types.
+ */
+const TITLE_WORDING_MAX_REFS = 5;
+/** Cap on names folded into one page-state fingerprint. */
+const MAX_FINGERPRINT_NAMES = 200;
+/**
+ * How deep the fingerprint reads. Deeper than the wording tiers on purpose: a
+ * fingerprint that only saw the top of the tree would call a page "unchanged"
+ * when a deep section revealed text without adding a new actionable element,
+ * and the backstop would then warn about a wall that is not there.
+ */
+const FINGERPRINT_DEPTH = 4;
+/** Collect accessible names breadth-first, bounded by depth and count. */
+function scan(nodes, depth, maxDepth, out, cap) {
+    if (nodes === undefined || out.length >= cap)
+        return;
+    for (const node of nodes) {
+        if (out.length >= cap)
+            return;
+        const name = node.name ?? '';
+        if (name !== '')
+            out.push({ role: (node.role ?? '').toLowerCase(), name });
+        if (depth < maxDepth)
+            scan(node.children, depth + 1, maxDepth, out, cap);
+    }
+}
+/** Evidence string when one header rule holds, else null. */
+function headerEvidence(rule, headers) {
+    if (headers === undefined)
+        return null;
+    const wanted = rule.name.toLowerCase();
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() !== wanted)
+            continue;
+        const value = headers[key] ?? '';
+        const lower = value.toLowerCase();
+        if (rule.equals !== undefined && lower !== rule.equals.toLowerCase())
+            return null;
+        if (rule.contains !== undefined && !lower.includes(rule.contains.toLowerCase()))
+            return null;
+        return key + ': ' + value;
+    }
+    return null;
+}
+/** Evidence string when any header name carries the prefix, else null. */
+function prefixEvidence(prefix, headers) {
+    if (headers === undefined)
+        return null;
+    const wanted = prefix.toLowerCase();
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase().startsWith(wanted))
+            return key + ': ' + (headers[key] ?? '');
+    }
+    return null;
+}
+/**
+ * Detect an anti-bot / human-verification surface from the MAIN document
+ * response metadata, the page's accessible names and, as a last resort, its
+ * wording. We never try to solve one: the correct move for an agent is to hand
+ * it to the human who can see the open window.
+ * @param snapshot - title, url, accessible tree and (when available) the main document response.
+ * @returns the matched engine with its tier and the concrete evidence, else null.
  */
 export function detectChallenge(snapshot) {
     const title = snapshot.title ?? '';
     const url = snapshot.url ?? '';
-    const parts = [];
-    const walk = (nodes, depth) => {
-        for (const node of nodes) {
-            if (parts.length >= 60)
-                return;
-            if (node.name !== undefined && node.name !== '')
-                parts.push(node.name);
-            if (depth < 2 && node.children !== undefined && node.children.length > 0)
-                walk(node.children, depth + 1);
+    const names = [];
+    scan(snapshot.nodes, 0, 2, names, MAX_NAMES);
+    // The widget tier gets its own, deeper scan (see WIDGET_DEPTH).
+    const widgetNames = [];
+    scan(snapshot.nodes, 0, WIDGET_DEPTH, widgetNames, MAX_WIDGET_NAMES);
+    const headers = snapshot.response?.headers;
+    const status = snapshot.response?.status;
+    const refs = snapshot.refs;
+    /**
+     * Some vendors put their header on every response, so the header alone is not a
+     * block: DataDome attaches `x-datadome*` to everything (their docs) and Imperva
+     * attaches `x-iinfo` to everything. A signature that lists `statuses` must have
+     * the status agree, or a perfectly good page is reported as a wall.
+     */
+    const statusAgrees = (required) => required === undefined || (status !== undefined && required.includes(status));
+    // Tier 1 — the vendor's own response metadata. This is their published API:
+    // Cloudflare documents cf-mitigated: challenge as the supported way to detect
+    // a challenge page, so a rename breaks every customer integration, not just us.
+    for (const signature of CHALLENGE_SIGNATURES) {
+        if (!statusAgrees(signature.statuses))
+            continue;
+        for (const rule of signature.headers ?? []) {
+            const evidence = headerEvidence(rule, headers);
+            if (evidence !== null) {
+                return { engine: signature.engine, hint: signature.hint, tier: 'response-header', evidence };
+            }
+        }
+        for (const prefix of signature.headerPrefixes ?? []) {
+            const evidence = prefixEvidence(prefix, headers);
+            if (evidence !== null) {
+                return { engine: signature.engine, hint: signature.hint, tier: 'response-header', evidence };
+            }
+        }
+    }
+    // Tier 2 — the vendor's own widget, by accessible name. An iframe's title is
+    // authored by the vendor, so it stands alone; the same word on an ordinary
+    // node needs corroboration from somewhere else on the page, because a page may
+    // simply discuss that vendor. Corroboration deliberately excludes the matched
+    // node itself: "reCAPTCHA" contains "captcha", and letting a token corroborate
+    // itself would make this guard vacuous.
+    for (const signature of CHALLENGE_SIGNATURES) {
+        const tokens = signature.widgetTokens;
+        if (tokens === undefined)
+            continue;
+        // No ref-count gate here on purpose. An earlier version required the page to be
+        // nearly unusable before a vendor iframe counted, which suppressed a genuine
+        // reCAPTCHA / hCaptcha / Turnstile simply because the login page around it had
+        // links (measured: a busy login page stopped being recognised at all). Login
+        // pages are the main case for this check, so the frame wins: a v3 badge on an
+        // ordinary page is reported as "a captcha is embedded here", which is true.
+        for (const node of widgetNames) {
+            // Frames only. The vendor's own widget is a frame in every real sample measured
+            // (reCAPTCHA, hCaptcha, Turnstile, Arkose): the deep scan exists to reach it.
+            // Accepting a token on an ordinary node was a regression — an article titled
+            // "How hCaptcha works" has h2/p nodes with the vendor word in them, and the
+            // wording elsewhere on the page ("verification", "challenge") then corroborated
+            // it, so a perfectly ordinary blog post rendered as a captcha wall.
+            if (node.role !== 'iframe' && node.role !== 'frame')
+                continue;
+            if (!tokens.some((token) => token.test(node.name)))
+                continue;
+            return {
+                engine: signature.engine,
+                hint: signature.hint,
+                tier: 'widget',
+                evidence: node.name.slice(0, 60),
+            };
+        }
+    }
+    // Tier 3 — wording, weakest of the three. A title is short and written by the
+    // interceptor, so it stands almost alone: the one extra condition is that the
+    // page must also be unusable (see TITLE_WORDING_MAX_REFS). A caller that does
+    // not report a ref count is treated as "nothing to click", because the
+    // alternative is silently switching this tier off.
+    // Fail closed: a caller that does not report a ref count gets no title tier at all.
+    // Leaving the gate open when refs was missing is how the false positive came back
+    // (the tests themselves passed a BrowserSnapshot, which has totalRefs but no refs).
+    const unusablePage = refs !== undefined && refs <= TITLE_WORDING_MAX_REFS;
+    const head = title + ' ' + url;
+    if (unusablePage) {
+        for (const signature of CHALLENGE_SIGNATURES) {
+            for (const pattern of signature.titleWording ?? []) {
+                if (!pattern.test(head))
+                    continue;
+                return {
+                    engine: signature.engine,
+                    hint: signature.hint,
+                    tier: 'wording',
+                    evidence: 'title: ' + title.slice(0, 60),
+                };
+            }
+        }
+        for (const pattern of WORDING_TITLE) {
+            if (!pattern.test(head))
+                continue;
+            return {
+                engine: 'human-verification',
+                hint: 'the page is asking to verify a human visitor',
+                tier: 'wording',
+                evidence: 'title: ' + title.slice(0, 60),
+            };
         }
-    };
-    walk(snapshot.nodes ?? [], 0);
-    const text = [title, url, ...parts].join(' | ').slice(0, 900);
-    const saidCaptcha = parts.some((name) => /(captcha|turnstile|recaptcha|hcaptcha)/i.test(name));
-    if (/just a moment|attention required|checking (your )?browser|cf-chl-|请稍候|验证你的浏览器/i.test(text))
-        return { engine: 'Cloudflare', hint: 'Cloudflare is challenging the browser before letting the page load' };
-    if (/verify (you are|you're|that you are) (a )?human|人机验证|验证您(是|为)人类/i.test(text))
-        return { engine: 'human-verification', hint: 'the page is asking to verify a human visitor' };
-    if (/(captcha|turnstile|recaptcha|hcaptcha)/i.test(text) &&
-        (saidCaptcha || /(captcha|turnstile|recaptcha)/i.test(title)))
-        return { engine: 'captcha', hint: 'the page embedded a captcha-style challenge' };
+    }
+    // Control-level wording is not gated the same way: it needs a short label on a
+    // control role, which an ordinary results page does not carry.
+    for (const node of names) {
+        if (node.name.length > MAX_CONTROL_LABEL)
+            continue;
+        if (WORDING_EXCLUDE.some((pattern) => pattern.test(node.name)))
+            continue;
+        const captchaControl = CAPTCHA_WORD.test(node.name) && CAPTCHA_ROLES.has(node.role);
+        const command = WORDING_COMMAND.some((pattern) => pattern.test(node.name));
+        if (!captchaControl && !command)
+            continue;
+        return {
+            engine: 'human-verification',
+            hint: 'the page is asking to verify a human visitor',
+            tier: 'wording',
+            evidence: node.role + ': ' + node.name.slice(0, 60),
+        };
+    }
     return null;
 }
 /**
@@ -38,3 +214,88 @@ export function detectChallenge(snapshot) {
  * should pause and ask the user to complete it by hand, then re-snapshot.
  */
 export const CHALLENGE_NOTE = "[human verification] The page triggered an anti-bot challenge; it is NOT solvable by automation and must NOT be retried blindly. The browser window is open on the user's desktop — tell the user a verification appeared, wait for them to finish it (a few seconds), then call browser_snapshot again. The clearance cookie is saved to the profile automatically and keeps working for the session.";
+/**
+ * Appended after an action that left the page byte-for-byte unchanged on a page
+ * with almost nothing else to interact with. Worded as a guess, because that is
+ * what it is: it is the shape an unrecognised wall has, and the whole point of
+ * this tier is to cover the vendors we have no signature for.
+ */
+export const NO_PROGRESS_NOTE = '[no visible change] that action left the page identical — same URL, same title, same elements — and the page offers almost nothing else to click. This is a guess, not a diagnosis: it is what an unrecognised anti-bot wall looks like. Take one browser_snapshot to confirm; if the page still looks unchanged, stop and tell the user what you were trying to do and ask them to look at the open window, instead of retrying the same action.';
+/** A page with at most this many actionable elements counts as "nearly empty". */
+export const NO_PROGRESS_MAX_REFS = 3;
+/** Cheap, order-stable hash (djb2) so a fingerprint costs no prompt budget. */
+function hash(text) {
+    let value = 5381;
+    for (let index = 0; index < text.length; index += 1) {
+        value = ((value << 5) + value + text.charCodeAt(index)) >>> 0;
+    }
+    return value.toString(36);
+}
+/**
+ * Identity of one page state: URL, title, actionable-element count and the
+ * accessible labels. Two captures with the same fingerprint look the same to a
+ * human glancing at the window, which is exactly the question this tier asks.
+ * @param input - the slice of a snapshot the backstop compares.
+ * @returns an opaque fingerprint string.
+ */
+export function snapshotFingerprint(input) {
+    const names = [];
+    scan(input.nodes, 0, FINGERPRINT_DEPTH, names, MAX_FINGERPRINT_NAMES);
+    const material = [
+        input.url ?? '',
+        input.title ?? '',
+        String(input.refs ?? 0),
+        names.map((node) => node.role + '=' + node.name).join('\u0001'),
+    ].join('\u0000');
+    return hash(material);
+}
+/**
+ * The no-progress backstop: a vendor we have never seen leaves no signature, so
+ * we stop asking "which wall is this" and ask "did anything happen". Deliberately
+ * conservative — it needs an identical page AND (a nearly empty page, or a second
+ * identical result), so an ordinary click that is not meant to change anything
+ * stays quiet.
+ * @param input - whether an action just ran, the identical-capture streak, and the ref count.
+ * @returns the advisory note, or null when the page is still plausibly alive.
+ */
+export function detectNoProgress(input) {
+    if (!input.afterAction)
+        return null;
+    if (input.unchangedStreak < 1)
+        return null;
+    const nearlyEmpty = input.refs <= NO_PROGRESS_MAX_REFS;
+    if (!nearlyEmpty && input.unchangedStreak < 2)
+        return null;
+    return NO_PROGRESS_NOTE;
+}
+/**
+ * Appended when a page has nothing to click and almost nothing to read. This is
+ * the blind spot the no-progress backstop cannot cover: that tier needs an action
+ * to compare before and after, and on a page with zero actionable elements the
+ * agent has no action to take — so the emptiest, most wall-like pages used to
+ * produce no message at all. Measured 2026-10-17 on 微博's visitor gate: the model
+ * received 364 characters, all of them "URL / Title / Refs: 0 / (no visible
+ * elements)", and nothing said the page was a gate rather than an empty document.
+ */
+export const SILENT_PAGE_NOTE = '[nothing here] this page has no clickable elements and almost no text: it may be a gate or visitor check that resolves by itself, a page that is still loading, or a page that needs a person. Wait a moment and take one more browser_snapshot; if it still looks like this, tell the user what you were trying to open and ask them to look at the open window, instead of re-sending the same navigation.';
+/** A page with no named node at all counts as "almost no text". Strict on purpose:
+ * one heading plus one paragraph is a normal page, not a silent one. */
+const SILENT_PAGE_MAX_NAMES = 0;
+/**
+ * Whether the page is a silent one: nothing to click and (almost) nothing to read.
+ * @param input - the action ref count and the accessible tree.
+ * @returns the advisory note, or null when the page has content worth reading.
+ */
+export function detectSilentPage(input) {
+    if (input.refs > 0)
+        return null;
+    // A page with no title at all is a bare document (about:blank, a raw image):
+    // calling that "maybe a gate" is noise, not a warning.
+    if (input.title !== undefined && input.title.trim() === '')
+        return null;
+    const names = [];
+    // Read as deep as the widget scan: a page whose only text sits six levels down is
+    // a normal page, and a depth-4 scan called it "almost no text" (review, P1-3).
+    scan(input.nodes, 0, WIDGET_DEPTH, names, SILENT_PAGE_MAX_NAMES + 1);
+    return names.length <= SILENT_PAGE_MAX_NAMES ? SILENT_PAGE_NOTE : null;
+}

package/lib/injected.js

@@ -203,6 +203,19 @@ export const SNAPSHOT_SCRIPT = String.raw `
     // Nearest ancestor name, used to fold a child that only repeats it.
     const inherited = typeof inheritedName === 'string' ? inheritedName : ''
     if (opts.interactiveOnly && !actionable) {
+      // Frames are the one non-actionable node kept. An iframe's accessible name
+      // is the embedded widget's own title ("reCAPTCHA", "Widget containing a
+      // Cloudflare security challenge"), and that title appears nowhere else in
+      // the tree — pruning it would hide a challenge widget from exactly the
+      // check that is supposed to recognise one.
+      if (role === 'iframe') {
+        state.count += 1
+        if (state.count > opts.maxNodes) {
+          state.truncated = true
+          return null
+        }
+        return { role, name: nameOf(el, opts.maxNameLength, opts.maxTextLength, false), children: [] }
+      }
       const kids = []
       for (const child of el.children) {
         if (SKIP_TAGS.has(child.tagName.toLowerCase())) continue

package/lib/page-actions.d.ts

@@ -26,14 +26,7 @@ export declare function assertActionable(_session: PlaywrightSession, locator: L
  * and hand the caller the pending state instead (Playwright-MCP pattern).
  */
 export declare function runAction(session: PlaywrightSession, page: Page, action: () => Promise<unknown>): Promise<ActionResult>;
-export declare function navigate(session: PlaywrightSession, url: string, waitUntil: LoadState, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
+export declare function navigate(session: PlaywrightSession, url: string, waitUntil: LoadState, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 /**
  * Codex-style click-point resolution. Tries a scroll-alignment ladder
  * (centre, then end, then start). For each alignment: scroll the element
@@ -56,55 +49,40 @@ export declare function resolveClickPoint(session: PlaywrightSession, locator: L
  * and the landing note names what was actually clicked plus how many
  * elements shared the label.
  */
-export declare function clickText(session: PlaywrightSession, text: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
+export declare function clickText(session: PlaywrightSession, text: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
+/**
+ * The href a click on this element would navigate to, for the URL policy.
+ * Its own href is not enough: a button or span nested inside an off-domain
+ * `<a href>` has no href itself yet the click bubbles into that link and
+ * navigates. The raw-coordinate path already checks the closest ancestor
+ * link; ref and text clicks must apply the same rule (B2 in the audit).
+ * Returns null when no link is involved, which the policy lets through.
+ */
+export declare function clickTargetHref(locator: Locator): Promise<string | null>;
 /**
  * Shared click core: enforce the URL policy for link targets, run the
  * Codex-style geometry ladder with the Playwright actionability fallback,
  * then report what actually received the click. The label names the target
  * in the landing note; shared is how many elements matched it (0 for refs).
  */
-export declare function clickLocator(session: PlaywrightSession, locator: Locator, signal: AbortSignal | undefined, label: string, shared: number): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
-export declare function clickAt(session: PlaywrightSession, x: number, y: number, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
-export declare function clickAtRef(session: PlaywrightSession, ref: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
+export declare function clickLocator(session: PlaywrightSession, locator: Locator, signal: AbortSignal | undefined, label: string, shared: number): Promise<import("./types.ts").BrowserSnapshot>;
+export declare function clickAt(session: PlaywrightSession, x: number, y: number, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
+export declare function clickAtRef(session: PlaywrightSession, ref: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function fill(session: PlaywrightSession, ref: string, text: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
+/**
+ * Normalize a field value before comparing. Two levels of forgiveness, both of them
+ * things a page does to a value *after* we wrote it, not differences in what we wrote:
+ * whitespace is collapsed, and everything that is not a letter or a digit is dropped
+ * (`1,000` ≡ `1000`) with case folded (`abc` ≡ `ABC`). That covers input masks and
+ * currency fields — which `browser_fill`'s own description names — while still failing
+ * a genuinely different value: `ABCD`→`ZZZZ`, `John`→`Jane` and `1234`→`12345` all
+ * differ once normalized. The old readback accepted a length tolerance and containment,
+ * which is how those used to report success (audit B4).
+ */
+export declare function normalizeFillText(value: string): string;
 /** Read the field back and decide whether the fill landed. */
 export declare function verifyFill(_session: PlaywrightSession, locator: Locator, tag: string, text: string): Promise<boolean>;
-export declare function press(session: PlaywrightSession, ref: string, key: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
+export declare function press(session: PlaywrightSession, ref: string, key: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 /**
  * Hover a trigger the snapshot gave no ref, addressed by its visible label
  * (e.g. a plain span that reveals a menu on mouseenter). The label must
@@ -122,13 +100,6 @@ export declare function hoverLocator(session: PlaywrightSession, locator: Locato
 export declare function scroll(session: PlaywrightSession, direction: 'up' | 'down', amount: number, ref: string | undefined, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function back(session: PlaywrightSession, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function forward(session: PlaywrightSession, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
-export declare function switchTab(session: PlaywrightSession, index: number, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot | {
-    url: string;
-    title: string;
-    nodes: never[];
-    totalRefs: number;
-    truncated: boolean;
-    dialogNote: string;
-}>;
+export declare function switchTab(session: PlaywrightSession, index: number, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function openTab(session: PlaywrightSession, url: string, waitUntil: LoadState, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function closeTab(session: PlaywrightSession, index: number, signal: AbortSignal | undefined): Promise<void>;

package/lib/page-actions.js

@@ -3,7 +3,7 @@
  * 滚动、前进后退、标签切换，以及承载它们的可中断等待管道（withAbort）。
  * @module dsh-browser-playwright-codex/page-actions
  */
-import { hitTest } from "./page-probes.js";
+import { clickTargetHrefProbe, hitTest } from "./page-probes.js";
 import { BrowserError } from "./errors.js";
 import { assertAllowedUrl } from "./url-policy.js";
 import { asTimeoutError, isAbortError } from "./page-diagnostics.js";
@@ -257,6 +257,17 @@ export async function clickText(session, text, signal) {
         }
     });
 }
+/**
+ * The href a click on this element would navigate to, for the URL policy.
+ * Its own href is not enough: a button or span nested inside an off-domain
+ * `<a href>` has no href itself yet the click bubbles into that link and
+ * navigates. The raw-coordinate path already checks the closest ancestor
+ * link; ref and text clicks must apply the same rule (B2 in the audit).
+ * Returns null when no link is involved, which the policy lets through.
+ */
+export async function clickTargetHref(locator) {
+    return (await locator.evaluate(clickTargetHrefProbe)) ?? null;
+}
 /**
  * Shared click core: enforce the URL policy for link targets, run the
  * Codex-style geometry ladder with the Playwright actionability fallback,
@@ -264,7 +275,7 @@ export async function clickText(session, text, signal) {
  * in the landing note; shared is how many elements matched it (0 for refs).
  */
 export async function clickLocator(session, locator, signal, label, shared) {
-    session.assertClickTargetAllowed(await locator.getAttribute('href'));
+    session.assertClickTargetAllowed(await clickTargetHref(locator));
     const page = session.currentPageSync();
     const urlBefore = page.url();
     let point;
@@ -396,8 +407,9 @@ export async function clickAtRef(session, ref, signal) {
         const page = session.currentPageSync();
         const urlBefore = page.url();
         // Ref mode resolves the element before clicking, so the link policy can
-        // be enforced up front — the same rule browser_click applies.
-        session.assertClickTargetAllowed(await locator.getAttribute('href'));
+        // be enforced up front — the same rule browser_click applies, including the
+        // ancestor link a nested control would navigate through.
+        session.assertClickTargetAllowed(await clickTargetHref(locator));
         try {
             // Codex-style geometry click with obstruction awareness:
             // scroll (centre → end → start), wait for the bounding rect to
@@ -492,9 +504,9 @@ export async function fill(session, ref, text, signal) {
                 lastError = error;
                 continue;
             }
-            // Post-action verification: read the value back. Lenient match
-            // so formatted/masked inputs do not false-positive, but a value
-            // that never stuck gets one retry then a clear diagnostic.
+            // Post-action verification: read the value back and require it to match
+            // what was typed (whitespace-normalized only), so a value the page ignored
+            // or rewrote gets one retry then a clear diagnostic.
             written = await session.verifyFill(locator, tag, text);
             if (written)
                 break;
@@ -507,24 +519,44 @@ export async function fill(session, ref, text, signal) {
         return session.settleAndSnapshot(page, false);
     });
 }
+/**
+ * Normalize a field value before comparing. Two levels of forgiveness, both of them
+ * things a page does to a value *after* we wrote it, not differences in what we wrote:
+ * whitespace is collapsed, and everything that is not a letter or a digit is dropped
+ * (`1,000` ≡ `1000`) with case folded (`abc` ≡ `ABC`). That covers input masks and
+ * currency fields — which `browser_fill`'s own description names — while still failing
+ * a genuinely different value: `ABCD`→`ZZZZ`, `John`→`Jane` and `1234`→`12345` all
+ * differ once normalized. The old readback accepted a length tolerance and containment,
+ * which is how those used to report success (audit B4).
+ */
+export function normalizeFillText(value) {
+    return String(value)
+        .normalize('NFKC')
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}]+/gu, '');
+}
 /** Read the field back and decide whether the fill landed. */
 export async function verifyFill(_session, locator, tag, text) {
+    const expected = normalizeFillText(text);
     try {
         if (tag === 'select') {
             const label = await locator.evaluate((el) => {
                 const o = el.selectedOptions[0];
                 return o === undefined ? '' : o.label;
             });
-            return label === text;
-        }
-        const value = await locator.inputValue();
-        if (value === text)
-            return true;
-        // Lenient: formatted inputs (masks, prefixes) rewrite the display
-        // value; accept containment or a near-equal length as "written".
-        return (text.length > 0 &&
-            value.length > 0 &&
-            (value.includes(text) || text.includes(value) || Math.abs(value.length - text.length) <= 2));
+            return normalizeFillText(label) === expected;
+        }
+        if (tag === 'input' || tag === 'textarea') {
+            return normalizeFillText(await locator.inputValue()) === expected;
+        }
+        // contenteditable / role=textbox elements have no inputValue(); calling it
+        // throws, which used to turn a fill that HAD landed into VALUE_NOT_SET.
+        // Judge the text the page would show instead.
+        const contents = await locator.evaluate((el) => {
+            const node = el;
+            return [el.textContent ?? '', typeof node.innerText === 'string' ? node.innerText : ''];
+        });
+        return contents.some((candidate) => normalizeFillText(candidate) === expected);
     }
     catch {
         return false;
@@ -630,7 +662,7 @@ export async function scroll(session, direction, amount, ref, signal) {
         // loaders a beat, then settle (bounded) before capturing.
         await withAbort(new Promise((resolve) => setTimeout(resolve, 450)), signal);
         await session.waitForPageStable(page, 1200);
-        return session.capture(page, undefined);
+        return session.capture(page, undefined, true);
     });
 }
 export async function back(session, signal) {

package/lib/page-diagnostics.d.ts

@@ -62,4 +62,9 @@ export declare function networkRequests(session: PlaywrightSession, args: {
         failure: string | null | undefined;
     }[];
 };
+/**
+ * Bounded page data for browser_extract. Credential values (password fields and
+ * password-autocomplete fields) are blanked inside the page before the payload
+ * leaves the browser: the extract prompt is sent to an auxiliary model.
+ */
 export declare function pageData(session: PlaywrightSession): Promise<unknown>;