dsh-browser-playwright-codex 0.6.5 → 0.7.0

package/lib/gates-patch.d.ts

@@ -0,0 +1,46 @@
+/** Managed block markers: everything between them belongs to this plugin. */
+export declare const BEGIN = "# >>> dsh-browser: \u6D4F\u89C8\u5668\u63D2\u4EF6\u914D\u7F6E\uFF08\u672C\u5757\u7531\u8BBE\u7F6E\u9875\u7EF4\u62A4\uFF0C\u4E5F\u53EF\u624B\u5DE5\u7F16\u8F91\uFF09>>>";
+export declare const END = "# <<< dsh-browser <<<";
+/**
+ * The pre-merge markers, written by dsh-browser-toggle 0.3.0. Accepted so an
+ * existing block is replaced in place instead of accumulating a second row that
+ * would patch the same entry twice.
+ */
+export declare const LEGACY_BEGIN = "# >>> dsh-browser-toggle: \u5F3A\u529B\u5DE5\u5177\u95F8\u95E8\uFF08\u672C\u5757\u7531\u8BBE\u7F6E\u9875\u7EF4\u62A4\uFF0C\u4E5F\u53EF\u624B\u5DE5\u7F16\u8F91\uFF09>>>";
+export declare const LEGACY_END = "# <<< dsh-browser-toggle <<<";
+/** Path of the home-level patch layer (highest priority among patch files). */
+export declare function homePatchPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * The managed block: one loader row for the whole plugin, with the shipped
+ * launch/provider/snapshot values repeated and the two gates filled in.
+ *
+ * @param allowEvaluate - register browser_evaluate
+ * @param allowCdp - register browser_cdp
+ * @returns the YAML block, markers included
+ */
+export declare function renderBrowserBlock(allowEvaluate: boolean, allowCdp: boolean): string;
+/** Merge the managed block into `original`, replacing an existing one in place. */
+export declare function mergeBrowserBlock(original: string, allowEvaluate: boolean, allowCdp: boolean): string;
+/** Read the current managed block, or undefined when there is none. */
+export declare function parseBrowserBlock(text: string): {
+    allowEvaluate: boolean;
+    allowCdp: boolean;
+} | undefined;
+/** Back-compat aliases used by the absorbed settings-card host half. */
+export declare const parseGatesBlock: typeof parseBrowserBlock;
+/** Back-compat alias (see {@link mergeBrowserBlock}). */
+export declare const mergeGatesBlock: typeof mergeBrowserBlock;
+/**
+ * Write both gates into the home-level patch. Backup first, atomic rename, then
+ * read back and check; on a failed check the previous bytes are restored.
+ *
+ * @param allowEvaluate - register browser_evaluate
+ * @param allowCdp - register browser_cdp
+ * @param env - environment (DSH_HOME override for tests)
+ * @returns the file written and the values it now carries
+ */
+export declare function writeGates(allowEvaluate: boolean, allowCdp: boolean, env?: NodeJS.ProcessEnv): Promise<{
+    patch: string;
+    allowEvaluate: boolean;
+    allowCdp: boolean;
+}>;

package/lib/gates-patch.js

@@ -0,0 +1,158 @@
+/**
+ * Home-level patch writer for the merged single-row plugin (2026-10-19).
+ *
+ * Reads and rewrites ONE managed block inside the home-level cordis.patch.yml
+ * (the patch layer with the highest priority, so the user's own choice wins over
+ * any profile layer and over the package default). Everything outside the block
+ * is preserved byte for byte.
+ *
+ * Why the block carries the WHOLE row: the loader replaces an entry's `config`
+ * wholesale, so a block that lists only the two gates would silently reset the
+ * launch options, the idle timeout and the snapshot engine to their defaults.
+ * The template below therefore mirrors cordis.patch.yml's shipped values and
+ * differs only in the two gate booleans.
+ *
+ * Dependency-free on purpose: a half-written patch layer breaks every plugin
+ * load in the profile, so this file only uses node builtins and stays testable
+ * on its own.
+ *
+ * @module dsh-browser-playwright-codex/gates-patch
+ */
+import { readFile, writeFile, rename, copyFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** Managed block markers: everything between them belongs to this plugin. */
+export const BEGIN = '# >>> dsh-browser: 浏览器插件配置（本块由设置页维护，也可手工编辑）>>>';
+export const END = '# <<< dsh-browser <<<';
+/**
+ * The pre-merge markers, written by dsh-browser-toggle 0.3.0. Accepted so an
+ * existing block is replaced in place instead of accumulating a second row that
+ * would patch the same entry twice.
+ */
+export const LEGACY_BEGIN = '# >>> dsh-browser-toggle: 强力工具闸门（本块由设置页维护，也可手工编辑）>>>';
+export const LEGACY_END = '# <<< dsh-browser-toggle <<<';
+/** Path of the home-level patch layer (highest priority among patch files). */
+export function homePatchPath(env = process.env) {
+    return join(env.DSH_HOME || join(homedir(), '.dsh'), 'cordis.patch.yml');
+}
+/**
+ * The managed block: one loader row for the whole plugin, with the shipped
+ * launch/provider/snapshot values repeated and the two gates filled in.
+ *
+ * @param allowEvaluate - register browser_evaluate
+ * @param allowCdp - register browser_cdp
+ * @returns the YAML block, markers included
+ */
+export function renderBrowserBlock(allowEvaluate, allowCdp) {
+    return [
+        BEGIN,
+        '# allowEvaluate: 注册 browser_evaluate（页面任意 JS，能用你的登录态操作网站）',
+        '# allowCdp:      注册 browser_cdp（原始 CDP，仅放行检查与输入模拟）',
+        '# 包内默认关闭；这里的值就是用户自己的选择。改完由热重载生效。',
+        '# 整行 config 会被整体替换，所以这里写全 —— 只写两个闸门会把其它设置重置成默认值。',
+        '- id: browser',
+        "  name: 'dsh-browser-playwright-codex'",
+        '  config:',
+        '    service:',
+        '      provider: playwright',
+        '    playwright:',
+        '      launch:',
+        '        headless: false',
+        '        persistent: true',
+        '        viewport:',
+        '          width: 1280',
+        '          height: 800',
+        '        navigationTimeoutMs: 30000',
+        '        ignoreHTTPSErrors: false',
+        '      idleTimeoutMs: 0',
+        '      maxSessions: 8',
+        '      snapshot:',
+        '        diff: false',
+        '    tool:',
+        '      toolPrefix: "browser_"',
+        '      allowEvaluate: ' + (allowEvaluate ? 'true' : 'false'),
+        '      allowCdp: ' + (allowCdp ? 'true' : 'false'),
+        '      registerDisabledTools: false',
+        '      diagnostics: false',
+        '      maxWaitMs: 60000',
+        END,
+        '',
+    ].join('\n');
+}
+/** Locate the managed block, preferring the current markers over the legacy ones. */
+function findBlock(original) {
+    const markers = [
+        [BEGIN, END],
+        [LEGACY_BEGIN, LEGACY_END],
+    ];
+    for (const [begin, end] of markers) {
+        const beginIdx = original.indexOf(begin);
+        const endIdx = original.indexOf(end);
+        if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
+            let after = endIdx + end.length;
+            if (original[after] === '\n')
+                after += 1;
+            return { start: beginIdx, after };
+        }
+    }
+    return undefined;
+}
+/** Merge the managed block into `original`, replacing an existing one in place. */
+export function mergeBrowserBlock(original, allowEvaluate, allowCdp) {
+    const block = renderBrowserBlock(allowEvaluate, allowCdp);
+    const found = findBlock(original);
+    if (found !== undefined)
+        return original.slice(0, found.start) + block + original.slice(found.after);
+    return (original === '' || original.endsWith('\n') ? original : original + '\n') + '\n' + block;
+}
+/** Read the current managed block, or undefined when there is none. */
+export function parseBrowserBlock(text) {
+    const found = findBlock(text);
+    if (found === undefined)
+        return undefined;
+    const body = text.slice(found.start, found.after);
+    const evaluate = /allowEvaluate:\s*(true|false)/.exec(body);
+    const cdp = /allowCdp:\s*(true|false)/.exec(body);
+    if (evaluate === null || cdp === null)
+        return undefined;
+    return { allowEvaluate: evaluate[1] === 'true', allowCdp: cdp[1] === 'true' };
+}
+/** Back-compat aliases used by the absorbed settings-card host half. */
+export const parseGatesBlock = parseBrowserBlock;
+/** Back-compat alias (see {@link mergeBrowserBlock}). */
+export const mergeGatesBlock = mergeBrowserBlock;
+/**
+ * Write both gates into the home-level patch. Backup first, atomic rename, then
+ * read back and check; on a failed check the previous bytes are restored.
+ *
+ * @param allowEvaluate - register browser_evaluate
+ * @param allowCdp - register browser_cdp
+ * @param env - environment (DSH_HOME override for tests)
+ * @returns the file written and the values it now carries
+ */
+export async function writeGates(allowEvaluate, allowCdp, env = process.env) {
+    const file = homePatchPath(env);
+    let original = '';
+    try {
+        original = await readFile(file, 'utf8');
+    }
+    catch {
+        original = '';
+    }
+    const next = mergeBrowserBlock(original, allowEvaluate, allowCdp);
+    if (original !== '')
+        await copyFile(file, file + '.bak-browser-toggle').catch(() => { });
+    const tmp = file + '.tmp-browser-toggle';
+    await writeFile(tmp, next, 'utf8');
+    await rename(tmp, file);
+    const check = await readFile(file, 'utf8');
+    const parsed = parseBrowserBlock(check);
+    if (parsed === undefined || parsed.allowEvaluate !== allowEvaluate || parsed.allowCdp !== allowCdp) {
+        if (original !== '') {
+            await writeFile(file, original, 'utf8');
+            throw new Error('patch self-check failed after write; previous content restored');
+        }
+        throw new Error('patch self-check failed after write');
+    }
+    return { patch: file, allowEvaluate, allowCdp };
+}

package/lib/index.d.ts

@@ -20,3 +20,8 @@ export { Config as PlaywrightConfigSchema } from './config.ts';
 export type { PlaywrightConfig, PageData } from './config.ts';
 export type { BrowserNode, BrowserProvider, BrowserSession, BrowserSnapshot, LoadState, ScreenshotCapture, TabInfo, } from './types.ts';
 export type { ToolConfig } from './tool.ts';
+export { Config as BrowserPluginConfigSchema, apply, name } from './plugin.ts';
+export type { BrowserPluginConfig } from './plugin.ts';
+export { apply as applyPlaywright, name as playwrightEntry, Config as PlaywrightEntryConfig } from './playwright.ts';
+export { apply as applyTools, name as toolEntry, Config as ToolEntryConfig } from './tool.ts';
+export { Config } from './plugin.ts';

package/lib/index.js

@@ -12,3 +12,9 @@ export { default as BrowserRuntime } from "./service.js";
 export { PlaywrightProvider } from "./provider.js";
 export { assertAllowedUrl } from "./url-policy.js";
 export { Config as PlaywrightConfigSchema } from "./config.js";
+// Single loader row (2026-10-19): the package root is the plugin. The three
+// sub-entries below stay importable, but the loader mounts this one.
+export { Config as BrowserPluginConfigSchema, apply, name } from "./plugin.js";
+export { apply as applyPlaywright, name as playwrightEntry, Config as PlaywrightEntryConfig } from "./playwright.js";
+export { apply as applyTools, name as toolEntry, Config as ToolEntryConfig } from "./tool.js";
+export { Config } from "./plugin.js";

package/lib/page-actions.d.ts

@@ -50,6 +50,15 @@ export declare function resolveClickPoint(session: PlaywrightSession, locator: L
  * elements shared the label.
  */
 export declare function clickText(session: PlaywrightSession, text: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
+/**
+ * The href a click on this element would navigate to, for the URL policy.
+ * Its own href is not enough: a button or span nested inside an off-domain
+ * `<a href>` has no href itself yet the click bubbles into that link and
+ * navigates. The raw-coordinate path already checks the closest ancestor
+ * link; ref and text clicks must apply the same rule (B2 in the audit).
+ * Returns null when no link is involved, which the policy lets through.
+ */
+export declare function clickTargetHref(locator: Locator): Promise<string | null>;
 /**
  * Shared click core: enforce the URL policy for link targets, run the
  * Codex-style geometry ladder with the Playwright actionability fallback,
@@ -59,7 +68,34 @@ export declare function clickText(session: PlaywrightSession, text: string, sign
 export declare function clickLocator(session: PlaywrightSession, locator: Locator, signal: AbortSignal | undefined, label: string, shared: number): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function clickAt(session: PlaywrightSession, x: number, y: number, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
 export declare function clickAtRef(session: PlaywrightSession, ref: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
+/**
+ * Does this field hold a secret (password, one-time code, card number)?
+ *
+ * Mechanism-level counterpart to the old promise "it never types your
+ * passwords": `browser_fill` refuses these fields so the promise is true by
+ * construction, not by the model remembering to behave. The visible window is
+ * where the human types them.
+ *
+ * @param spec - tag / type / autocomplete read from the live element
+ * @returns true when the field must be filled by the human
+ */
+export declare function isCredentialField(spec: {
+    tag: string;
+    type?: string;
+    autocomplete?: string;
+}): boolean;
 export declare function fill(session: PlaywrightSession, ref: string, text: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;
+/**
+ * Normalize a field value before comparing. Two levels of forgiveness, both of them
+ * things a page does to a value *after* we wrote it, not differences in what we wrote:
+ * whitespace is collapsed, and everything that is not a letter or a digit is dropped
+ * (`1,000` ≡ `1000`) with case folded (`abc` ≡ `ABC`). That covers input masks and
+ * currency fields — which `browser_fill`'s own description names — while still failing
+ * a genuinely different value: `ABCD`→`ZZZZ`, `John`→`Jane` and `1234`→`12345` all
+ * differ once normalized. The old readback accepted a length tolerance and containment,
+ * which is how those used to report success (audit B4).
+ */
+export declare function normalizeFillText(value: string): string;
 /** Read the field back and decide whether the fill landed. */
 export declare function verifyFill(_session: PlaywrightSession, locator: Locator, tag: string, text: string): Promise<boolean>;
 export declare function press(session: PlaywrightSession, ref: string, key: string, signal: AbortSignal | undefined): Promise<import("./types.ts").BrowserSnapshot>;

package/lib/page-actions.js

@@ -3,7 +3,7 @@
  * 滚动、前进后退、标签切换，以及承载它们的可中断等待管道（withAbort）。
  * @module dsh-browser-playwright-codex/page-actions
  */
-import { hitTest } from "./page-probes.js";
+import { clickTargetHrefProbe, hitTest } from "./page-probes.js";
 import { BrowserError } from "./errors.js";
 import { assertAllowedUrl } from "./url-policy.js";
 import { asTimeoutError, isAbortError } from "./page-diagnostics.js";
@@ -257,6 +257,17 @@ export async function clickText(session, text, signal) {
         }
     });
 }
+/**
+ * The href a click on this element would navigate to, for the URL policy.
+ * Its own href is not enough: a button or span nested inside an off-domain
+ * `<a href>` has no href itself yet the click bubbles into that link and
+ * navigates. The raw-coordinate path already checks the closest ancestor
+ * link; ref and text clicks must apply the same rule (B2 in the audit).
+ * Returns null when no link is involved, which the policy lets through.
+ */
+export async function clickTargetHref(locator) {
+    return (await locator.evaluate(clickTargetHrefProbe)) ?? null;
+}
 /**
  * Shared click core: enforce the URL policy for link targets, run the
  * Codex-style geometry ladder with the Playwright actionability fallback,
@@ -264,7 +275,7 @@ export async function clickText(session, text, signal) {
  * in the landing note; shared is how many elements matched it (0 for refs).
  */
 export async function clickLocator(session, locator, signal, label, shared) {
-    session.assertClickTargetAllowed(await locator.getAttribute('href'));
+    session.assertClickTargetAllowed(await clickTargetHref(locator));
     const page = session.currentPageSync();
     const urlBefore = page.url();
     let point;
@@ -396,8 +407,9 @@ export async function clickAtRef(session, ref, signal) {
         const page = session.currentPageSync();
         const urlBefore = page.url();
         // Ref mode resolves the element before clicking, so the link policy can
-        // be enforced up front — the same rule browser_click applies.
-        session.assertClickTargetAllowed(await locator.getAttribute('href'));
+        // be enforced up front — the same rule browser_click applies, including the
+        // ancestor link a nested control would navigate through.
+        session.assertClickTargetAllowed(await clickTargetHref(locator));
         try {
             // Codex-style geometry click with obstruction awareness:
             // scroll (centre → end → start), wait for the bounding rect to
@@ -468,13 +480,55 @@ export async function clickAtRef(session, ref, signal) {
         }
     });
 }
+/** Autocomplete tokens whose value is a secret the human should type in the window. */
+const CREDENTIAL_AUTOCOMPLETE = new Set([
+    'current-password',
+    'new-password',
+    'one-time-code',
+    'cc-number',
+    'cc-csc',
+    'cc-exp',
+    'cc-exp-month',
+    'cc-exp-year',
+]);
+/**
+ * Does this field hold a secret (password, one-time code, card number)?
+ *
+ * Mechanism-level counterpart to the old promise "it never types your
+ * passwords": `browser_fill` refuses these fields so the promise is true by
+ * construction, not by the model remembering to behave. The visible window is
+ * where the human types them.
+ *
+ * @param spec - tag / type / autocomplete read from the live element
+ * @returns true when the field must be filled by the human
+ */
+export function isCredentialField(spec) {
+    const tag = spec.tag.toLowerCase();
+    if (tag !== 'input' && tag !== 'textarea')
+        return false;
+    if ((spec.type ?? '').toLowerCase() === 'password')
+        return true;
+    const tokens = (spec.autocomplete ?? '').toLowerCase().trim().split(/\s+/);
+    const token = tokens[tokens.length - 1] ?? '';
+    return CREDENTIAL_AUTOCOMPLETE.has(token);
+}
 export async function fill(session, ref, text, signal) {
     return session.run(async () => {
         const locator = await session.refLocator(ref);
         const page = session.currentPageSync();
         await session.waitForElementStable(locator);
         await session.assertActionable(locator, { editable: true });
-        const tag = await locator.evaluate((el) => el.tagName.toLowerCase()).catch(() => 'input');
+        const spec = await locator
+            .evaluate((el) => {
+            const tag = el.tagName.toLowerCase();
+            const type = tag === 'input' ? String(el.type || '').toLowerCase() : '';
+            return { tag, type, autocomplete: el.getAttribute('autocomplete') ?? '' };
+        })
+            .catch(() => ({ tag: 'input', type: '', autocomplete: '' }));
+        if (isCredentialField(spec)) {
+            throw new BrowserError('CREDENTIAL_FIELD', 'browser_fill refuses credential fields (password, one-time code, card number): a human types those in the visible window. Ask the user to type it there, then take a fresh snapshot and continue with the rest.');
+        }
+        const tag = spec.tag;
         let lastError;
         let written = false;
         for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -492,9 +546,9 @@ export async function fill(session, ref, text, signal) {
                 lastError = error;
                 continue;
             }
-            // Post-action verification: read the value back. Lenient match
-            // so formatted/masked inputs do not false-positive, but a value
-            // that never stuck gets one retry then a clear diagnostic.
+            // Post-action verification: read the value back and require it to match
+            // what was typed (whitespace-normalized only), so a value the page ignored
+            // or rewrote gets one retry then a clear diagnostic.
             written = await session.verifyFill(locator, tag, text);
             if (written)
                 break;
@@ -507,24 +561,44 @@ export async function fill(session, ref, text, signal) {
         return session.settleAndSnapshot(page, false);
     });
 }
+/**
+ * Normalize a field value before comparing. Two levels of forgiveness, both of them
+ * things a page does to a value *after* we wrote it, not differences in what we wrote:
+ * whitespace is collapsed, and everything that is not a letter or a digit is dropped
+ * (`1,000` ≡ `1000`) with case folded (`abc` ≡ `ABC`). That covers input masks and
+ * currency fields — which `browser_fill`'s own description names — while still failing
+ * a genuinely different value: `ABCD`→`ZZZZ`, `John`→`Jane` and `1234`→`12345` all
+ * differ once normalized. The old readback accepted a length tolerance and containment,
+ * which is how those used to report success (audit B4).
+ */
+export function normalizeFillText(value) {
+    return String(value)
+        .normalize('NFKC')
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}]+/gu, '');
+}
 /** Read the field back and decide whether the fill landed. */
 export async function verifyFill(_session, locator, tag, text) {
+    const expected = normalizeFillText(text);
     try {
         if (tag === 'select') {
             const label = await locator.evaluate((el) => {
                 const o = el.selectedOptions[0];
                 return o === undefined ? '' : o.label;
             });
-            return label === text;
-        }
-        const value = await locator.inputValue();
-        if (value === text)
-            return true;
-        // Lenient: formatted inputs (masks, prefixes) rewrite the display
-        // value; accept containment or a near-equal length as "written".
-        return (text.length > 0 &&
-            value.length > 0 &&
-            (value.includes(text) || text.includes(value) || Math.abs(value.length - text.length) <= 2));
+            return normalizeFillText(label) === expected;
+        }
+        if (tag === 'input' || tag === 'textarea') {
+            return normalizeFillText(await locator.inputValue()) === expected;
+        }
+        // contenteditable / role=textbox elements have no inputValue(); calling it
+        // throws, which used to turn a fill that HAD landed into VALUE_NOT_SET.
+        // Judge the text the page would show instead.
+        const contents = await locator.evaluate((el) => {
+            const node = el;
+            return [el.textContent ?? '', typeof node.innerText === 'string' ? node.innerText : ''];
+        });
+        return contents.some((candidate) => normalizeFillText(candidate) === expected);
     }
     catch {
         return false;

package/lib/page-diagnostics.d.ts

@@ -62,4 +62,9 @@ export declare function networkRequests(session: PlaywrightSession, args: {
         failure: string | null | undefined;
     }[];
 };
+/**
+ * Bounded page data for browser_extract. Credential values (password fields and
+ * password-autocomplete fields) are blanked inside the page before the payload
+ * leaves the browser: the extract prompt is sent to an auxiliary model.
+ */
 export declare function pageData(session: PlaywrightSession): Promise<unknown>;

package/lib/page-diagnostics.js

@@ -173,6 +173,11 @@ export function networkRequests(session, args) {
         })),
     };
 }
+/**
+ * Bounded page data for browser_extract. Credential values (password fields and
+ * password-autocomplete fields) are blanked inside the page before the payload
+ * leaves the browser: the extract prompt is sent to an auxiliary model.
+ */
 export async function pageData(session) {
     return session.run(async () => {
         session.assertLive();
@@ -182,7 +187,38 @@ export async function pageData(session) {
             const fn = window.__dshPageData;
             if (typeof fn !== 'function')
                 return { url: location.href, title: document.title, text: '', truncated: false, links: [], inputs: [] };
-            return fn({ maxTextChars: 30000, maxLinks: 300, maxInputs: 200 });
+            const data = fn({ maxTextChars: 30000, maxLinks: 300, maxInputs: 200 });
+            // Credentials never leave the page. __dshPageData reads every field's current
+            // value, and browser_extract pastes that object into an auxiliary model's
+            // prompt, so a login or change-password page put the plaintext password into
+            // that prompt (audit B3). The field itself stays — "there is a password box
+            // here" is useful page structure — but its value is blanked. The collector and
+            // this pass use the same selector over the same document, so the i-th entry is
+            // the i-th field.
+            if (data !== null && Array.isArray(data.inputs)) {
+                const fields = document.querySelectorAll('input, select, textarea');
+                for (let index = 0; index < data.inputs.length; index += 1) {
+                    const entry = data.inputs[index];
+                    const field = fields[index];
+                    if (entry === undefined || field === undefined)
+                        continue;
+                    const type = (field.getAttribute('type') ?? '').toLowerCase();
+                    const autocomplete = (field.getAttribute('autocomplete') ?? '').toLowerCase();
+                    if (type === 'password' ||
+                        autocomplete.includes('current-password') ||
+                        autocomplete.includes('new-password') ||
+                        // One-time codes and card numbers are just as sensitive as passwords: a
+                        // 2FA code in the prompt can be replayed, and a card number is payment
+                        // data (independent review, P2-7). The field stays, its value does not.
+                        autocomplete.includes('one-time-code') ||
+                        autocomplete.includes('cc-number') ||
+                        autocomplete.includes('cc-csc') ||
+                        autocomplete.includes('cc-exp')) {
+                        entry['value'] = '';
+                    }
+                }
+            }
+            return data;
         };
         let data;
         try {

package/lib/page-probes.d.ts

@@ -55,6 +55,18 @@ export declare const pageStabilityProbe: (arg: {
     frames: number;
     timeoutMs: number;
 }) => Promise<boolean>;
+/**
+ * The href a click on this element would follow: the element's own href, or the
+ * nearest ancestor `<a href>` — crossing shadow-root boundaries, the same way the
+ * hit-test walks. Raw-coordinate clicks already check `closest('a[href]')`; ref and
+ * text clicks used to look only at the element itself, so a button/span nested in an
+ * off-domain `<a>` reached the outside host while every check passed. This probe is
+ * that missing layer: locator.evaluate(clickTargetHrefProbe).
+ *
+ * A policy check, not a navigation: `javascript:` hrefs are returned as-is and the
+ * caller's session policy keeps its existing exemption for them.
+ */
+export declare const clickTargetHrefProbe: (el: Element) => string | null;
 /**
  * The click-point hit test, moved out of the session so it lives with the other page-side
  * functions: it is serialized into the page by locator.evaluate(), so the same

package/lib/page-probes.js

@@ -201,6 +201,39 @@ export const pageStabilityProbe = (arg) => new Promise((resolve) => {
     ];
     requestAnimationFrame(tick);
 });
+/**
+ * The href a click on this element would follow: the element's own href, or the
+ * nearest ancestor `<a href>` — crossing shadow-root boundaries, the same way the
+ * hit-test walks. Raw-coordinate clicks already check `closest('a[href]')`; ref and
+ * text clicks used to look only at the element itself, so a button/span nested in an
+ * off-domain `<a>` reached the outside host while every check passed. This probe is
+ * that missing layer: locator.evaluate(clickTargetHrefProbe).
+ *
+ * A policy check, not a navigation: `javascript:` hrefs are returned as-is and the
+ * caller's session policy keeps its existing exemption for them.
+ */
+export const clickTargetHrefProbe = (el) => {
+    const own = el.getAttribute('href');
+    if (own !== null && own !== '')
+        return own;
+    let node = el;
+    // Document order upward, hopping from a shadow root to its host when the
+    // element lives inside one. The seen guard makes a malformed cycle terminate.
+    const seen = [];
+    while (node !== null) {
+        if (seen.indexOf(node) !== -1)
+            break;
+        seen.push(node);
+        const anchor = node.closest('a[href]');
+        if (anchor !== null)
+            return anchor.getAttribute('href');
+        const root = node.getRootNode
+            ? node.getRootNode()
+            : null;
+        node = root !== null && root !== undefined && root.host !== undefined ? root.host : null;
+    }
+    return null;
+};
 export const hitTest = (el) => {
     const r = el.getBoundingClientRect();
     const w = r.width;

package/lib/page-snapshot.js

@@ -110,9 +110,9 @@ export async function captureAria(session, page, opts) {
         const legacy = await session.captureLegacy(page, opts);
         return {
             ...legacy,
-            engineNote: 'smart mode could not read session page, so it was rendered with the compatible engine. ' +
+            engineNote: 'smart mode could not read this page, so it was rendered with the compatible engine. ' +
                 'The refs below belong to the compatible engine. Nothing is wrong with the page; ' +
-                'switch the page-reading mode in Settings if you want to stop seeing session.',
+                'switch the page-reading mode in Settings if you would rather not see this fallback notice.',
         };
     }
     return {

package/lib/plugin.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The single loader entry: one package = one plugin (2026-10-19).
+ *
+ * Why this file exists: `dsh-client-modules` rejects distinct active Loader
+ * sources that resolve to the same package name, and a Settings card needs a
+ * client module. The browser capability used to be mounted as three rows
+ * (`/service`, `/playwright`, `/tool`) because it has three configurable
+ * concerns, which forced the card into a second package (dsh-browser-toggle).
+ * One row per package makes the card legal inside this package, so the whole
+ * product is now one plugin: this entry mounts the three concerns as child
+ * plugins and keeps their own config schemas untouched.
+ *
+ * Config shape (see cordis.patch.yml):
+ *
+ *     service:    { provider }                     browser seam
+ *     playwright: { launch, idleTimeoutMs, ... }   provider / window / snapshot
+ *     tool:       { toolPrefix, allowEvaluate, ... } the model-facing tools
+ *
+ * Each child still exports its original schema and apply(), so the subpath
+ * entries (`./service`, `./playwright`, `./tool`) keep working for tests, the
+ * verify script and anyone importing the package directly.
+ *
+ * @module dsh-browser-playwright-codex/plugin
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { type BrowserRuntimeConfig } from './service.ts';
+import { type PlaywrightConfig } from './config.ts';
+import { type ToolConfig } from './tool.ts';
+/** Config accepted by the single loader row. */
+export interface BrowserPluginConfig {
+    /** Browser seam: which registered provider to use. */
+    service?: BrowserRuntimeConfig;
+    /** Provider: window, launch and snapshot settings. */
+    playwright?: PlaywrightConfig;
+    /** Model-facing tools: prefix, capability gates, wait caps. */
+    tool?: ToolConfig;
+}
+/** Schemastery validation for {@link BrowserPluginConfig}. */
+export declare const Config: z<BrowserPluginConfig>;
+/** Cordis plugin name used by loader diagnostics (this is the row id in patches). */
+export declare const name = "browser";
+/**
+ * Mount the whole capability: the seam, the Playwright provider, the tool family,
+ * and — when the deployment has a web server — the Settings card.
+ *
+ * @param ctx - plugin context
+ * @param config - nested config for each concern; the loader fills defaults
+ */
+export declare function apply(ctx: Context, config: BrowserPluginConfig): void;
+declare const _default: {
+    name: string;
+    Config: z<BrowserPluginConfig>;
+    apply: typeof apply;
+};
+export default _default;