opencode-browser-annotation-plugin 0.6.0 → 0.6.1

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "OpenCode Browser Annotation",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Alt+A to annotate an element, Alt+Shift+A for the annotation list. Sends element metadata to your OpenCode agent.",
   "permissions": [
     "activeTab",

package/extension/overlay.js

@@ -355,9 +355,18 @@
     try {
       const tag = el.tagName.toLowerCase();
       const attrs = [];
+      const nameAttr = el.getAttribute("name") || "";
+      const typeAttr = el.getAttribute("type") || "";
+      // Redact the value= of any input whose name/type looks sensitive (CSRF
+      // tokens, passwords, hidden auth fields), regardless of input type.
+      const valueIsSecret = SECRET_ATTR.test(nameAttr) || /password|hidden/i.test(typeAttr);
       for (const a of Array.from(el.attributes || [])) {
+        // Skip class/style: class is already captured (cleaned) in `classes`,
+        // and inline style is noise. This avoids duplication and the ugly
+        // mid-class truncation.
+        if (a.name === "class" || a.name === "style") continue;
         let v = a.value;
-        if (SECRET_ATTR.test(a.name) || (a.name === "value" && /password|hidden/i.test(el.getAttribute("type") || ""))) {
+        if (SECRET_ATTR.test(a.name) || (a.name === "value" && valueIsSecret)) {
           v = "[redacted]";
         } else if (v && v.length > 120) {
           v = v.slice(0, 120) + "…";
@@ -365,7 +374,7 @@
         attrs.push(v === "" ? a.name : `${a.name}="${v}"`);
       }
       const open = `<${tag}${attrs.length ? " " + attrs.join(" ") : ""}>`;
-      return open.slice(0, 600);
+      return open;
     } catch {
       return undefined;
     }
@@ -395,6 +404,9 @@
       framework: fw ? fw.framework : undefined,
       html: safeOpenTag(el),
     };
+    // Drop the opening tag if it carries no attributes beyond the tag name
+    // (redundant with `tag` once class/style are excluded).
+    if (m.html && /^<[a-z0-9-]+>$/i.test(m.html)) delete m.html;
     for (const k of Object.keys(m)) if (m[k] === undefined) delete m[k];
     if (Array.isArray(m.ancestors) && m.ancestors.length === 0) delete m.ancestors;
     return m;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-browser-annotation-plugin",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Select an element in your browser, type an instruction, and send it to your OpenCode agent over a loopback + SSH tunnel. Text and element metadata only (no screenshots).",
   "keywords": [
     "opencode",