teamshare-bridge 0.21.24 → 0.21.27

package/dist/cli/commands/browse.js

@@ -59,6 +59,8 @@ const child_process_1 = require("child_process");
 const cdp_1 = require("../../lib/browser/cdp");
 const launch_1 = require("../../lib/browser/launch");
 const session_1 = require("../../lib/browser/session");
+const personal_fields_1 = require("../../lib/browser/personal-fields");
+const human_input_guard_1 = require("../../lib/browser/human-input-guard");
 /** Create a fingerprint from the current element list. */
 function createFingerprint(elements) {
     const groups = new Map();
@@ -119,6 +121,7 @@ const SYSTEM_PROMPT = `You are a browser automation agent. A screenshot and a gr
 Your task: identify unanswered questions and answer them by clicking the correct elements.
 
 RULES (STRICT):
+0. BE FAST AND DECISIVE. Answer in a single pass with minimal reasoning — do NOT deliberate at length, re-check repeatedly, or restate the page. Emit the final JSON array as your primary output. Speed matters more than exhaustive deliberation.
 1. NEVER click Next, Submit, Back, Save, Continue, or any navigation. ONLY answer questions on the current screen.
 2. NEVER ask for help. If uncertain, pick the BEST GUESS. Always decide — never wait.
 3. Handle MULTIPLE unanswered questions in a SINGLE response.
@@ -238,10 +241,10 @@ CORRECTION MODE:
 - If you previously typed wrong code, use write_code to replace with correct code
 - You may be asked the same question multiple times — each time, check if the current answer is correct before acting
 
-PERSONAL QUESTIONS — SKIP THEM:
-- NEVER type answers for questions asking: name, email, phone, address, SSN, password, credit card, date of birth, or any personal information
-- If a question asks for personal info, do NOT click or type — skip it entirely
-- If ALL remaining questions are personal, return done
+PERSONAL QUESTIONS — NEVER ANSWER THEM:
+- Questions about the person operating the browser (name, email, phone, address, SSN, passport, password, card, bank, date of birth, salary, work authorization, personal profile links) are OFF LIMITS. Read the PERSONAL QUESTIONS addendum appended below and follow it exactly.
+- If a question asks for personal info, do NOT click or type — leave it empty.
+- A personal field left empty is NOT an unanswered question. If ALL remaining questions are personal, return done immediately.
 
 RESPONSE FORMAT RULES (CRITICAL — follow exactly):
 - Return ONLY a valid JSON array. No explanations, no markdown fences, no extra text.
@@ -257,6 +260,133 @@ RESPONSE FORMAT RULES (CRITICAL — follow exactly):
 - RIGHT: {"text":"say \\"hello\\""}
 - NEVER put raw newlines or unescaped quotes inside the text string.
 - If you need to explain your reasoning, use the "reason" field, NOT the "text" field.`;
+/**
+ * Enable the Page domain and install the per-tab instrumentation the loop
+ * relies on: the stealth console wrapper, the Page.frameNavigated listener and
+ * the debounced MutationObserver. Extracted so every (re)attach - including a
+ * tab switch/close - re-runs it on the NEW tab. All of it must be idempotent
+ * (the injected scripts already early-return when their Symbol key exists).
+ */
+async function instrumentPage(page) {
+    try {
+        await cdpSend(page, 'Page.enable', {});
+        console.log('[browse] Page domain enabled');
+    }
+    catch (err) {
+        console.error(`[browse] Page.enable failed: ${(0, config_1.msg)(err)}`);
+    }
+    // Stealth: install stack trace sanitization to hide CDP frames (global, once)
+    installStackTraceStealth();
+    // Stealth: suppress console serialization leak caused by CDP's Runtime.enable.
+    // Anti-bot probe: Object.defineProperty(obj,'x',{get(){window.__detected=1}});
+    //   console.debug(obj); if(window.__detected) → CDP is serializing args
+    // Countermeasure: wrap console methods to prevent deep serialization.
+    try {
+        await cdpEval(page, `
+      (() => {
+        const CK = Symbol('__ts_cp');
+        if (window[CK]) return;
+        const wrap = (fn) => function(...args) {
+          return fn.apply(console, args.map(a => {
+            if (a && typeof a === 'object' && typeof a !== 'function') {
+              try { return Object.assign(Array.isArray(a) ? [] : {}, a); } catch { return a; }
+            }
+            return a;
+          }));
+        };
+        console.debug = wrap(console.debug);
+        console.log = wrap(console.log);
+        console.warn = wrap(console.warn);
+        console.error = wrap(console.error);
+        window[CK] = true;
+      })()
+    `);
+    }
+    catch { /* non-critical */ }
+    // Register CDP event: Page.frameNavigated (URL/navigation changes)
+    onCdpEvent(page, 'Page.frameNavigated', () => {
+        page._cdpNavigated = Date.now();
+    });
+    // Inject MutationObserver: watches DOM for significant content changes
+    // Uses same fingerprint comparison as Node.js side to prevent false positives.
+    // Filters out: timers, animations, scripts, styles, notifications, toasts.
+    // Debounces mutations (500ms) to batch rapid changes.
+    // Stealth: uses Symbol-keyed property (invisible to Object.keys / anti-bot scans).
+    try {
+        await cdpEval(page, `
+      (() => {
+        const KEY = Symbol('__ts_obs');
+        if (window[KEY]) return 'already attached';
+        const IGNORE = /timer|countdown|elapsed|clock|animation|animate|transition|spinner|progress|loading|toast|notification|alert|banner|snackbar|cookie|consent|modal|overlay|popup|tooltip|badge|tag|avatar|icon|svg|img|video|audio|canvas|font|stylesheet|script|meta|link|head/i;
+        let timer = null;
+        let lastText = '';
+        function getText() {
+          const els = document.querySelectorAll('input[type="radio"],input[type="checkbox"],input[type="text"],input[type="email"],input[type="password"],textarea,label,button');
+          return [...els].map(e => {
+            const t = (e.innerText || e.textContent || '').trim().replace(/\\s+/g, ' ').slice(0, 200);
+            return e.type + '|' + t + '|' + (e.checked || false);
+          }).join('\\n');
+        }
+        function check() {
+          try {
+            const curr = getText();
+            if (curr === lastText) return;
+            const prev = lastText;
+            lastText = curr;
+            const prevGroups = prev ? prev.split('\\n').filter(Boolean) : [];
+            const currGroups = curr.split('\\n').filter(Boolean);
+            const prevSet = new Set(prevGroups);
+            const currSet = new Set(currGroups);
+            let removed = 0, changed = 0;
+            for (const g of prevGroups) {
+              if (!currSet.has(g)) {
+                if (prevGroups.indexOf(g) < currGroups.length) changed++;
+                else removed++;
+              }
+            }
+            const added = currGroups.filter(g => !prevSet.has(g)).length;
+            const score = added * 10 + removed * 10 + changed * 8;
+            if (score >= 15) {
+              window[KEY].changed = Date.now();
+            }
+          } catch {}
+        }
+        const obs = new MutationObserver((mutations) => {
+          let hasRelevant = false;
+          for (const m of mutations) {
+            if (m.target instanceof Element) {
+              const tag = m.target.tagName;
+              if (tag === 'SCRIPT' || tag === 'STYLE' || tag === 'HEAD') continue;
+              const cls = m.target.className || '';
+              if (typeof cls === 'string' && IGNORE.test(cls)) continue;
+              const id = m.target.id || '';
+              if (IGNORE.test(id)) continue;
+              if (m.type === 'characterData' && m.target.parentElement) {
+                const ptag = m.target.parentElement.tagName;
+                if (ptag === 'SCRIPT' || ptag === 'STYLE') continue;
+              }
+            }
+            hasRelevant = true;
+          }
+          if (hasRelevant) {
+            clearTimeout(timer);
+            timer = setTimeout(check, 500);
+          }
+        });
+        obs.observe(document.body || document.documentElement, {
+          childList: true, subtree: true, characterData: true
+        });
+        window[KEY] = { observer: obs, changed: 0 };
+        lastText = getText();
+        return 'ok';
+      })()
+    `);
+        console.log('[browse] MutationObserver injected (stealth, debounced, filtered)');
+    }
+    catch (err) {
+        console.error(`[browse] MutationObserver injection failed: ${(0, config_1.msg)(err)}`);
+    }
+}
 async function cmdBrowse(flags) {
     const autoAnswer = flags.get('auto-answer') === 'true';
     if (!autoAnswer) {
@@ -316,15 +446,33 @@ async function cmdBrowse(flags) {
     const maxActions = continuous ? Number.MAX_SAFE_INTEGER : parseInt(flags.get('max-actions') ?? '50', 10);
     const intervalMs = parseInt(flags.get('interval') ?? '2000', 10);
     const modelSpec = flags.get('model') ?? models_1.DEFAULT_VISION_MODEL;
-    const timeoutSec = Math.min(Math.max(parseInt(flags.get('timeout') ?? '300', 10), 30), 600);
+    // Target: a decisive answer in well under a minute. 60s is the abandon
+    // threshold (overridable); the fast abort + short retry below makes giving up
+    // cheap, so we never wait 5 minutes for a stale decision.
+    const timeoutSec = Math.min(Math.max(parseInt(flags.get('timeout') ?? '60', 10), 20), 600);
     const timeoutMs = timeoutSec * 1000;
-    const quality = Math.min(Math.max(parseInt(flags.get('quality') ?? '78', 10), 50), 100);
+    const quality = Math.min(Math.max(parseInt(flags.get('quality') ?? '70', 10), 50), 100);
+    /**
+     * Downscale the screenshot when the viewport is bigger than this many px on
+     * its longest side (fewer image tokens => faster vision response on big
+     * pages; a 1440px page produced 100KB+ images that blew the timeout).
+     */
+    const SCREENSHOT_MAX_EDGE = 1024;
     const maxConsecutiveFailures = parseInt(flags.get('max-consecutive-failures') ?? '0', 10); // 0 = unlimited
     const charDelayMs = Math.min(Math.max(parseInt(flags.get('char-delay') ?? '150', 10), 5), 200);
     const optimize = flags.has('optimize');
     const stealth = flags.has('stealth');
     const hybrid = flags.has('hybrid');
     const autoLaunch = flags.has('auto-launch');
+    // Field safety (see personal-fields.ts / human-input-guard.ts):
+    //   --stop-on-user-input   opt-in: stop typing and skip the field for the run
+    //                          as soon as the human types into it
+    //   --personal-questions   "allow" answers personal questions; credentials and
+    //                          card/bank fields stay blocked either way
+    const stopOnUserInput = flags.has('stop-on-user-input') && flags.get('stop-on-user-input') !== 'false';
+    const personalMode = (flags.get('personal-questions') ?? 'skip').toLowerCase();
+    fieldSafety.stopOnUserInput = stopOnUserInput;
+    fieldSafety.allowPersonal = personalMode === 'allow';
     // The auto-answer browser is ALWAYS visible (2026-09): a headless window is
     // the "profile seems mismatched" case and hides the pages the loop works on.
     // `--headless` is accepted for backward compatibility but ignored.
@@ -356,6 +504,8 @@ async function cmdBrowse(flags) {
     }
     console.log(`[browse] Char delay: ${charDelayMs}ms`);
     console.log(`[browse] Screenshot interval: ${intervalMs}ms`);
+    console.log(`[browse] Personal questions: ${fieldSafety.allowPersonal ? 'answered (credentials still blocked)' : 'never answered (left for you)'}`);
+    console.log(`[browse] Stop typing when you type in the field: ${fieldSafety.stopOnUserInput ? 'on' : 'off'}`);
     if (!stealth) {
         console.log(`[browse] Max consecutive failures: ${maxConsecutiveFailures === 0 ? 'unlimited' : maxConsecutiveFailures}`);
     }
@@ -400,125 +550,9 @@ async function cmdBrowse(flags) {
         process.exitCode = 1;
         return;
     }
-    // Enable Page domain (required for captureScreenshot)
-    try {
-        await cdpSend(page, 'Page.enable', {});
-        console.log('[browse] Page domain enabled');
-    }
-    catch (err) {
-        console.error(`[browse] Page.enable failed: ${(0, config_1.msg)(err)}`);
-    }
-    // Stealth: install stack trace sanitization to hide CDP frames
-    installStackTraceStealth();
-    // Stealth: suppress console serialization leak caused by CDP's Runtime.enable.
-    // Anti-bot probe: Object.defineProperty(obj,'x',{get(){window.__detected=1}});
-    //   console.debug(obj); if(window.__detected) → CDP is serializing args
-    // Countermeasure: wrap console methods to prevent deep serialization.
-    try {
-        await cdpEval(page, `
-      (() => {
-        const CK = Symbol('__ts_cp');
-        if (window[CK]) return;
-        const wrap = (fn) => function(...args) {
-          return fn.apply(console, args.map(a => {
-            if (a && typeof a === 'object' && typeof a !== 'function') {
-              try { return Object.assign(Array.isArray(a) ? [] : {}, a); } catch { return a; }
-            }
-            return a;
-          }));
-        };
-        console.debug = wrap(console.debug);
-        console.log = wrap(console.log);
-        console.warn = wrap(console.warn);
-        console.error = wrap(console.error);
-        window[CK] = true;
-      })()
-    `);
-    }
-    catch { /* non-critical */ }
-    // Register CDP event: Page.frameNavigated (URL/navigation changes)
-    onCdpEvent(page, 'Page.frameNavigated', () => {
-        page._cdpNavigated = Date.now();
-    });
-    // Inject MutationObserver: watches DOM for significant content changes
-    // Uses same fingerprint comparison as Node.js side to prevent false positives.
-    // Filters out: timers, animations, scripts, styles, notifications, toasts.
-    // Debounces mutations (500ms) to batch rapid changes.
-    // Stealth: uses Symbol-keyed property (invisible to Object.keys / anti-bot scans).
-    try {
-        await cdpEval(page, `
-      (() => {
-        const KEY = Symbol('__ts_obs');
-        if (window[KEY]) return 'already attached';
-        const IGNORE = /timer|countdown|elapsed|clock|animation|animate|transition|spinner|progress|loading|toast|notification|alert|banner|snackbar|cookie|consent|modal|overlay|popup|tooltip|badge|tag|avatar|icon|svg|img|video|audio|canvas|font|stylesheet|script|meta|link|head/i;
-        let timer = null;
-        let lastText = '';
-        function getText() {
-          const els = document.querySelectorAll('input[type="radio"],input[type="checkbox"],input[type="text"],input[type="email"],input[type="password"],textarea,label,button');
-          return [...els].map(e => {
-            const t = (e.innerText || e.textContent || '').trim().replace(/\\s+/g, ' ').slice(0, 200);
-            return e.type + '|' + t + '|' + (e.checked || false);
-          }).join('\\n');
-        }
-        function check() {
-          try {
-            const curr = getText();
-            if (curr === lastText) return;
-            const prev = lastText;
-            lastText = curr;
-            const prevGroups = prev ? prev.split('\\n').filter(Boolean) : [];
-            const currGroups = curr.split('\\n').filter(Boolean);
-            const prevSet = new Set(prevGroups);
-            const currSet = new Set(currGroups);
-            let removed = 0, changed = 0;
-            for (const g of prevGroups) {
-              if (!currSet.has(g)) {
-                if (prevGroups.indexOf(g) < currGroups.length) changed++;
-                else removed++;
-              }
-            }
-            const added = currGroups.filter(g => !prevSet.has(g)).length;
-            const score = added * 10 + removed * 10 + changed * 8;
-            if (score >= 15) {
-              window[KEY].changed = Date.now();
-            }
-          } catch {}
-        }
-        const obs = new MutationObserver((mutations) => {
-          let hasRelevant = false;
-          for (const m of mutations) {
-            if (m.target instanceof Element) {
-              const tag = m.target.tagName;
-              if (tag === 'SCRIPT' || tag === 'STYLE' || tag === 'HEAD') continue;
-              const cls = m.target.className || '';
-              if (typeof cls === 'string' && IGNORE.test(cls)) continue;
-              const id = m.target.id || '';
-              if (IGNORE.test(id)) continue;
-              if (m.type === 'characterData' && m.target.parentElement) {
-                const ptag = m.target.parentElement.tagName;
-                if (ptag === 'SCRIPT' || ptag === 'STYLE') continue;
-              }
-            }
-            hasRelevant = true;
-          }
-          if (hasRelevant) {
-            clearTimeout(timer);
-            timer = setTimeout(check, 500);
-          }
-        });
-        obs.observe(document.body || document.documentElement, {
-          childList: true, subtree: true, characterData: true
-        });
-        window[KEY] = { observer: obs, changed: 0 };
-        lastText = getText();
-        return 'ok';
-      })()
-    `);
-        console.log('[browse] MutationObserver injected (stealth, debounced, filtered)');
-    }
-    catch (err) {
-        console.error(`[browse] MutationObserver injection failed: ${(0, config_1.msg)(err)}`);
-    }
+    // Enable Page + install per-tab instrumentation. Re-run on every (re)attach
+    // so a tab switch/close leaves the loop fully instrumented.
+    await instrumentPage(page);
     // Agent loop
     let actionCount = 0;
     let llmCallCount = 0;
@@ -530,6 +564,81 @@ async function cmdBrowse(flags) {
     /** A 401/403 from the model API: terminal, retrying cannot succeed. */
     let fatalAuthError = false;
     const maxRetries = 5;
+    /** How often to re-check which tab is active (ms). */
+    const TAB_CHECK_MS = 2000;
+    let lastTabCheck = 0;
+    let consecutiveScreenshotFailures = 0;
+    let reattachFailures = 0;
+    // Latency observability: rolling average of vision-call latency plus
+    // abort/timeout counts, so the operator can see how slow the model is.
+    const llmStats = { calls: 0, ok: 0, screenAborts: 0, timeouts: 0, totalMs: 0 };
+    const logLlmStats = () => {
+        if (llmStats.calls === 0 || llmStats.calls % 5 !== 0)
+            return;
+        const avg = Math.round(llmStats.totalMs / llmStats.calls / 1000);
+        console.log(`[browse] LLM latency: avg ${avg}s over ${llmStats.calls} call(s) — ${llmStats.ok} ok, ${llmStats.screenAborts} screen-abort, ${llmStats.timeouts} timeout`);
+    };
+    /**
+     * (Re)attach to a tab. A closed or switched tab used to leave the loop
+     * hammering a dead target ("CDP timeout: Page.captureScreenshot") forever;
+     * now we detect it and follow the tab the human is actually on.
+     */
+    async function reattach(reason, preferTargetId) {
+        console.log(`[browse] ${reason} - re-attaching...`);
+        try {
+            page.ws.close();
+        }
+        catch {
+            /* already closed */
+        }
+        page = await connectToPage(port, preferTargetId);
+        await instrumentPage(page);
+        // A different tab means different content: reset change trackers.
+        lastFingerprint = null;
+        lastScreenshot = null;
+        codeConfirmedOptimal = false;
+        consecutiveFailures = 0;
+        consecutiveScreenshotFailures = 0;
+        console.log(`[browse] Re-attached to tab: ${page.title} (${page.targetId.slice(0, 8)})`);
+    }
+    /**
+     * Throttled liveness check: is the bound tab still alive and the active one?
+     * Follows the human's active tab (and recovers after it is closed). `force`
+     * skips the throttle (used from the screenshot-failure path).
+     */
+    async function refreshTabIfNeeded(force = false) {
+        if (!force && Date.now() - lastTabCheck < TAB_CHECK_MS)
+            return false;
+        lastTabCheck = Date.now();
+        try {
+            if (page.disconnected) {
+                // The bound tab is gone: move straight to whatever tab is active now.
+                const active = await (0, cdp_1.pickActiveTab)(port).catch(() => null);
+                await reattach('Bound tab closed', active?.id);
+                reattachFailures = 0;
+                return true;
+            }
+            const active = await (0, cdp_1.pickActiveTab)(port, page.targetId);
+            if (!active)
+                return false;
+            if (active.id !== page.targetId) {
+                await reattach(`Active tab changed to "${active.title}"`, active.id);
+                reattachFailures = 0;
+                return true;
+            }
+            return false;
+        }
+        catch (err) {
+            reattachFailures++;
+            console.error(`[browse] Re-attach attempt ${reattachFailures} failed: ${(0, config_1.msg)(err)}`);
+            if (reattachFailures >= 6) {
+                console.error('[browse] Could not re-attach to any tab - stopping.');
+                stopped = true;
+                process.exitCode = 1;
+            }
+            return false;
+        }
+    }
     process.on('SIGINT', () => {
         console.log('\n[browse] Stopped by user');
         stopped = true;
@@ -538,17 +647,26 @@ async function cmdBrowse(flags) {
     console.log(`[browse] Agent started. ${continuous ? 'Running until Ctrl+C.' : `Max ${maxActions} actions.`} Press Ctrl+C to stop.\n`);
     while (!stopped && actionCount < maxActions) {
         try {
+            // Follow the human's active tab: re-attach if the bound tab was closed or
+            // the user switched to another one.
+            await refreshTabIfNeeded();
             // Take screenshot and extract elements in parallel
             const [screenshot, elements, pageContext] = await Promise.all([
-                captureScreenshot(page, quality),
+                captureScreenshot(page, quality, SCREENSHOT_MAX_EDGE),
                 extractElements(page),
                 extractPageContext(page),
             ]);
             if (!screenshot) {
-                console.error('[browse] Failed to capture screenshot, retrying...');
+                consecutiveScreenshotFailures++;
+                console.error(`[browse] Failed to capture screenshot (${consecutiveScreenshotFailures}), retrying...`);
+                // Two failures in a row generally means the target is gone.
+                if (consecutiveScreenshotFailures >= 2) {
+                    await refreshTabIfNeeded(true);
+                }
                 await sleep(intervalMs);
                 continue;
             }
+            consecutiveScreenshotFailures = 0;
             // Detect screen change via question fingerprint comparison
             // Threshold 15: requires ≥1 new/removed question (10) + text change (8) = 18,
             // or 2 text changes (16). Score of 5 (single option change) is too sensitive.
@@ -568,29 +686,47 @@ async function cmdBrowse(flags) {
             const actionLabel = continuous ? `${actionCount + 1}/∞` : `${actionCount + 1}/${maxActions}`;
             console.log(`[browse] [${actionLabel}] Analyzing screenshot...`);
             let result = null;
+            /** The page changed under the LLM: re-analyze immediately, no backoff. */
+            let screenChangedDuringLlm = false;
             for (let attempt = 1; attempt <= maxRetries; attempt++) {
                 result = await analyzeScreenshot(baseUrl, apiKey, model, screenshot, elements, pageContext, timeoutMs, attempt, maxRetries, page, lastFingerprint);
                 llmCallCount++;
+                llmStats.calls++;
+                llmStats.totalMs += result.durationMs;
                 if (llmCallCount > 50 && llmCallCount % 25 === 0) {
                     console.log(`[browse] Warning: ${llmCallCount} LLM calls made — may hit rate limits`);
                 }
-                if (result.actions.length > 0)
+                if (result.actions.length > 0) {
+                    llmStats.ok++;
+                    logLlmStats();
                     break; // success
+                }
                 // Auth failure is terminal: retrying cannot help.
                 if (result.error === 'auth_error') {
                     fatalAuthError = true;
                     break;
                 }
-                // Timeout → exponential backoff, keep retrying (never count as failure)
+                // The screen changed while the LLM was thinking: its answer is stale.
+                // Bail out of the retry loop and re-analyze the NEW screen right away
+                // (speed matters: a 30s backoff here livelocked on dynamic pages).
+                if (result.error === 'screen_changed') {
+                    screenChangedDuringLlm = true;
+                    llmStats.screenAborts++;
+                    logLlmStats();
+                    break;
+                }
+                // Genuine timeout → SHORT backoff and retry (was 30/60/120/240/300s).
                 if (result.error === 'timeout') {
-                    const backoff = Math.min(30 * Math.pow(2, attempt - 1), 300); // 30, 60, 120, 240, 300
+                    llmStats.timeouts++;
+                    logLlmStats();
+                    const backoff = Math.min(3 * attempt, 12); // 3, 6, 9, 12, 12
                     console.log(`[browse] LLM timed out — retrying in ${backoff}s (attempt ${attempt}/${maxRetries})...`);
                     await sleep(backoff * 1000);
                     continue;
                 }
-                // Other errors → short backoff
+                // Other errors → very short backoff
                 if (attempt < maxRetries) {
-                    const backoff = attempt === 1 ? 3 : 5;
+                    const backoff = 2;
                     console.log(`[browse] ${result.error === 'empty' ? 'Empty response' : 'Parse failed'} (attempt ${attempt}/${maxRetries}), retrying in ${backoff}s...`);
                     await sleep(backoff * 1000);
                 }
@@ -601,6 +737,10 @@ async function cmdBrowse(flags) {
                 process.exitCode = 1;
                 break;
             }
+            if (screenChangedDuringLlm) {
+                // No sleep: go straight back to the top, re-screenshot + re-analyze.
+                continue;
+            }
             if (!result || result.actions.length === 0) {
                 consecutiveFailures++;
                 console.log(`[browse] No valid response after ${maxRetries} attempts (${consecutiveFailures} consecutive failures)`);
@@ -699,6 +839,18 @@ async function cmdBrowse(flags) {
                     console.log(`[browse] Skipping ${act.action} — code already confirmed optimal`);
                     continue;
                 }
+                // Field safety: never type into a personal field, a credential field, or
+                // a field the human already answered themselves.
+                if (act.action === 'write_code' || act.action === 'type') {
+                    const targetEl = act.elementIndex !== undefined
+                        ? elements.find((e) => e.i === act.elementIndex)
+                        : undefined;
+                    const gated = fieldGate(targetEl);
+                    if (gated) {
+                        console.log(`[browse] Skipping element ${act.elementIndex} - ${gated}`);
+                        continue;
+                    }
+                }
                 // Ask LLM to decide if action is redundant
                 const redundancy = await isActionRedundant(baseUrl, apiKey, model, page, elements, act, timeoutMs);
                 if (redundancy.decision === 'skip') {
@@ -890,6 +1042,14 @@ Do NOT simplify variable names or change the function signature. Only optimize t
         console.log(`[browse] Reached max actions (${maxActions})`);
     }
     console.log(`[browse] Agent finished. ${actionCount} actions performed.`);
+    const skipped = personalSkipSummary();
+    if (skipped.personal > 0 || skipped.human > 0) {
+        console.log(`[browse] Left for you: ${skipped.personal} personal question(s) never answered` +
+            (skipped.human > 0 ? `, ${skipped.human} field(s) you answered yourself` : ''));
+        for (const entry of skippedFields.values()) {
+            console.log(`  - ${entry.note}`);
+        }
+    }
     page.ws.close();
 }
 // ── CDP Helpers ──────────────────────────────────────────────────────────────
@@ -897,11 +1057,11 @@ Do NOT simplify variable names or change the function signature. Only optimize t
  * Connect directly to a page's WebSocket from /json/list.
  * This avoids the Target.attachToTarget complexity.
  */
-async function connectToPage(port) {
+async function connectToPage(port, preferTargetId) {
     // Shared picker (cdp.ts): prefers a real page, accepts about:blank/new-tab,
     // and opens a blank tab if none exists - so a Chrome launched on the NTP is
     // still attachable. (Was a local chrome:// filter that could never match.)
-    const pageTarget = await (0, cdp_1.resolveAttachablePage)(port);
+    const pageTarget = await (0, cdp_1.resolveAttachablePage)(port, preferTargetId);
     const wsUrl = pageTarget.webSocketDebuggerUrl;
     return new Promise((resolve, reject) => {
         const ws = new ws_1.default(wsUrl);
@@ -958,6 +1118,8 @@ async function connectToPage(port) {
             }
         });
         ws.on('close', () => {
+            // The endpoint is gone: flag it so the agent loop can re-attach.
+            page.disconnected = true;
             // Reject all pending
             for (const [id, p] of page.pending) {
                 p.reject(new Error('WebSocket closed'));
@@ -1022,9 +1184,32 @@ function cdpSend(page, method, params) {
         page.ws.send(JSON.stringify({ id, method, params }));
     });
 }
-async function captureScreenshot(page, quality) {
+/**
+ * Capture the visible viewport as JPEG. When the viewport is larger than
+ * `maxEdge` on either side the capture is scaled down (`clip.scale`) so the
+ * vision call stays fast: a big page produced 100KB+ images that exceeded the
+ * model timeout. Clicking is unaffected — actions use element coordinates
+ * (CSS px), not image pixels.
+ */
+async function captureScreenshot(page, quality, maxEdge = 0) {
     try {
-        const result = await cdpSend(page, 'Page.captureScreenshot', { format: 'jpeg', quality });
+        const params = { format: 'jpeg', quality };
+        if (maxEdge > 0) {
+            try {
+                const metrics = await cdpSend(page, 'Page.getLayoutMetrics', {});
+                const vp = metrics?.cssLayoutViewport ?? metrics?.layoutViewport;
+                const w = Number(vp?.clientWidth ?? 0);
+                const h = Number(vp?.clientHeight ?? 0);
+                if (w > 0 && h > 0 && (w > maxEdge || h > maxEdge)) {
+                    const scale = Math.min(maxEdge / w, maxEdge / h);
+                    params.clip = { x: 0, y: 0, width: w, height: h, scale };
+                }
+            }
+            catch {
+                /* metrics unavailable - capture unscaled */
+            }
+        }
+        const result = await cdpSend(page, 'Page.captureScreenshot', params);
         return result?.data ?? null;
     }
     catch (err) {
@@ -1032,6 +1217,124 @@ async function captureScreenshot(page, quality) {
         return null;
     }
 }
+/**
+ * Field-safety addendum appended to every system prompt (main loop, custom /
+ * optimization passes, stealth loop). The loop may not answer questions that
+ * ask about the human behind the browser.
+ */
+const PERSONAL_SAFETY_RULES = `
+PERSONAL QUESTIONS - NEVER ANSWER THEM:
+- Some questions ask about YOU (the human operating the browser), not about the
+  task. NEVER answer them with an invented value.
+- Never type: names, email addresses, phone numbers, postal addresses, dates of
+  birth or age, government IDs (SSN/NIN/passport/driving licence/tax id),
+  passwords, one-time codes, card or bank details, salary or compensation,
+  notice periods, work-authorization/visa/sponsorship answers, or personal
+  profile links (LinkedIn, GitHub, portfolio, personal website).
+- Fields marked "[NEVER ANSWER: ...]" or "[PERSONAL: ...]" in the element list
+  MUST be left untouched - do not click them, do not type into them.
+- Leaving a personal field EMPTY is correct and expected. A personal field is
+  NOT an unanswered question: never treat it as one, and never delay "done"
+  because of it.
+- If every remaining question is personal, return done.
+- Demographics and free-text personal questions (gender, marital status, "tell
+  us about yourself") are the human's to answer: prefer to skip them too.
+`;
+const fieldSafety = {
+    stopOnUserInput: false,
+    allowPersonal: false,
+};
+/** fieldKey -> why the field must not be typed into for the rest of the run. */
+const skippedFields = new Map();
+/**
+ * Stealth mode has no DOM, so fields are identified by the focused OS control
+ * (AutomationId|ClassName|Name) instead of a field key.
+ */
+const skippedOsFields = new Map();
+function signalsOf(el) {
+    return {
+        tag: el.tag,
+        type: el.type,
+        name: el.name,
+        id: el.id,
+        autocomplete: el.autocomplete,
+        placeholder: el.placeholder,
+        ariaLabel: el.ariaLabel,
+        label: el.label,
+        questionText: el.questionText,
+        text: el.text,
+    };
+}
+function classificationOf(el) {
+    return {
+        tier: el.personalTier ?? null,
+        category: el.personalCategory ?? null,
+        label: el.personalLabel ?? '',
+        reason: el.personalReason ?? '',
+    };
+}
+/**
+ * Classify every typable element and stamp its stable field key. Elements are
+ * annotated in place so the gate below never re-parses the DOM.
+ */
+function annotateFieldSafety(elements) {
+    for (const el of elements) {
+        const signals = signalsOf(el);
+        el.fieldKey = (0, personal_fields_1.fieldKeyOf)(signals);
+        if (!el.typable)
+            continue;
+        const cls = (0, personal_fields_1.classifyField)(signals);
+        el.personalTier = cls.tier;
+        el.personalCategory = cls.category;
+        el.personalLabel = cls.label;
+        el.personalReason = cls.reason;
+    }
+}
+function shortLabel(el) {
+    const raw = el.label || el.questionText || el.text || el.placeholder || el.name || '';
+    return raw.replace(/\s+/g, ' ').trim().slice(0, 60);
+}
+/**
+ * Returns a human-readable reason when this element must not be typed into,
+ * or null when it is fine to type.
+ */
+function fieldGate(el) {
+    if (!el || !el.typable)
+        return null;
+    const key = el.fieldKey ?? (0, personal_fields_1.fieldKeyOf)(signalsOf(el));
+    const already = skippedFields.get(key);
+    if (already)
+        return already.note;
+    const cls = classificationOf(el);
+    if (cls.tier === null)
+        return null;
+    if (!(0, personal_fields_1.isBlocked)(cls, { allowPersonal: fieldSafety.allowPersonal }))
+        return null;
+    const note = `left to you (${cls.category}: "${shortLabel(el) || cls.label}")`;
+    skippedFields.set(key, { kind: 'personal', note });
+    console.log(`[browse] Not answering a personal question - ${note}`);
+    return note;
+}
+/** Record a field the human took over mid-typing; it is never typed again. */
+function noteHumanTookOver(el, reason) {
+    const key = el?.fieldKey ?? (el ? (0, personal_fields_1.fieldKeyOf)(signalsOf(el)) : '');
+    if (!key)
+        return;
+    const note = `you answered this one yourself (${reason})`;
+    skippedFields.set(key, { kind: 'human', note });
+    console.log(`[browse] Stopped typing - ${note}`);
+}
+function personalSkipSummary() {
+    let personal = 0;
+    let human = 0;
+    for (const entry of skippedFields.values()) {
+        if (entry.kind === 'personal')
+            personal++;
+        else
+            human++;
+    }
+    return { personal, human };
+}
 /**
  * Extract all interactive elements from the DOM with their exact text,
  * bounding boxes, state, and question group assignments.
@@ -1072,6 +1375,29 @@ async function extractElements(page) {
           text,
           tag: el.tagName.toLowerCase(),
           type: el.type || el.getAttribute('role') || '',
+          typable: el.tagName === 'INPUT' || el.tagName === 'TEXTAREA' || el.isContentEditable === true,
+          name: el.getAttribute('name') || '',
+          id: el.getAttribute('id') || '',
+          autocomplete: el.getAttribute('autocomplete') || '',
+          placeholder: el.getAttribute('placeholder') || '',
+          ariaLabel: el.getAttribute('aria-label') || '',
+          label: (() => {
+            try {
+              const id = el.getAttribute('id');
+              if (id) {
+                const forLabel = document.querySelector('label[for="' + CSS.escape(id) + '"]');
+                if (forLabel && forLabel.innerText) return forLabel.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              }
+              const wrap = el.closest ? el.closest('label') : null;
+              if (wrap && wrap.innerText) return wrap.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              const labelled = el.getAttribute('aria-labelledby');
+              if (labelled) {
+                const t = document.getElementById(labelled);
+                if (t && t.innerText) return t.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              }
+            } catch (err) {}
+            return '';
+          })(),
           checked: el.checked || el.getAttribute('aria-checked') === 'true' || false,
           x: Math.round(rect.x + rect.width / 2),
           y: Math.round(rect.y + rect.height / 2),
@@ -1184,6 +1510,13 @@ async function extractElements(page) {
           y: item.y,
           group: item.groupId,
           inViewport: item.inViewport,
+          typable: item.typable,
+          name: item.name,
+          id: item.id,
+          autocomplete: item.autocomplete,
+          placeholder: item.placeholder,
+          ariaLabel: item.ariaLabel,
+          label: item.label,
         });
       });
 
@@ -1192,7 +1525,9 @@ async function extractElements(page) {
   `;
     try {
         const result = await cdpEval(page, js);
-        return result?.result?.value || [];
+        const elements = result?.result?.value || [];
+        annotateFieldSafety(elements);
+        return elements;
     }
     catch {
         return [];
@@ -1241,6 +1576,11 @@ async function executeAction(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 // 1. Detect editor type
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
@@ -1255,12 +1595,19 @@ async function executeAction(page, act, elements, charDelayMs) {
                 // 3. Normalize indentation for code editors (LLM often adds extra indent)
                 const text = isCodeEditor ? normalizeCodeIndent(rawText) : rawText;
                 console.log(`[browse] Typing ${text.length} characters...`);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
                 if (isCodeEditor) {
-                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs);
+                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs, guard);
                 }
                 else {
-                    await insertIntoGenericInput(page, el, text, charDelayMs);
+                    await insertIntoGenericInput(page, el, text, charDelayMs, guard);
                 }
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'write_code': {
@@ -1271,6 +1618,11 @@ async function executeAction(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 // 1. Detect editor type
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
@@ -1283,13 +1635,20 @@ async function executeAction(page, act, elements, charDelayMs) {
                     .replace(/\\"/g, '"')
                     .replace(/\\\\/g, '\\');
                 console.log(`[browse] Writing code (${text.length} chars)...`);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
                 // 3. write_code inserts EXACTLY as-is — no normalizeCodeIndent
                 if (isCodeEditor) {
-                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs);
+                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs, guard);
                 }
                 else {
-                    await insertIntoGenericInput(page, el, text, charDelayMs);
+                    await insertIntoGenericInput(page, el, text, charDelayMs, guard);
                 }
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'scroll': {
@@ -1363,6 +1722,11 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
                 if (editor)
@@ -1381,7 +1745,16 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     pressKeyOS('ctrl+a');
                     await sleep(randomInt(50, 100));
                 }
-                await typeHumanLike(text, charDelayMs);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
+                if (guard)
+                    await guard.arm({ isCodeEditor });
+                await typeHumanLike(text, charDelayMs, guard);
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'write_code': {
@@ -1392,6 +1765,11 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
                 if (editor)
@@ -1409,7 +1787,16 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     pressKeyOS('ctrl+a');
                     await sleep(randomInt(50, 100));
                 }
-                await typeHumanLike(text, charDelayMs);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
+                if (guard)
+                    await guard.arm({ isCodeEditor });
+                await typeHumanLike(text, charDelayMs, guard);
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'scroll': {
@@ -1596,13 +1983,21 @@ function hasUnansweredQuestions(elements) {
         const types = els.map((e) => e.type);
         const isRadio = types.some((t) => t === 'radio');
         const isCheckbox = types.some((t) => t === 'checkbox');
-        const hasInput = els.some((e) => e.tag === 'input' || e.tag === 'textarea');
+        // Personal fields are the human's to answer: they are never "unanswered"
+        // for the agent, so a `done` from the model with them left empty sticks
+        // instead of triggering the "you must answer everything" retry loop.
+        const inputs = els.filter((e) => (e.tag === 'input' || e.tag === 'textarea') &&
+            e.type !== 'radio' &&
+            e.type !== 'checkbox' &&
+            e.typable !== false);
+        const openInputs = inputs.filter((e) => !(0, personal_fields_1.excludesFromCompleteness)(classificationOf(e)));
+        const hasInput = openInputs.length > 0;
         const checkedCount = els.filter((e) => e.checked).length;
         if (isRadio && checkedCount === 0)
             return true;
         if (isCheckbox && checkedCount < els.length)
             return true;
-        if (hasInput && !els.some((e) => e.text && e.tag === 'input'))
+        if (hasInput && !openInputs.some((e) => e.text && e.tag === 'input'))
             return true;
     }
     return false;
@@ -1827,7 +2222,7 @@ async function removeTrailingBrackets(page) {
     console.log(`[browse] Removed ${extra} extra trailing bracket(s)`);
 }
 /** Insert text into ANY code editor — character-by-character typing, no pasting. */
-async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
+async function insertIntoCodeEditor(page, selector, text, charDelayMs, guard) {
     // Focus the editor
     await focusSelector(page, selector);
     await sleep(100);
@@ -1879,8 +2274,12 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
     // Type character by character — NO pasting
     const est = Math.round(text.length * charDelayMs / 1000);
     console.log(`[browse] Typing ${text.length} chars (~${est}s est.)...`);
+    if (guard)
+        await guard.arm({ selector, isCodeEditor: true });
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
+        if (guard)
+            await guard.markOwn(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         if (char === '\n') {
             await cdpSend(page, 'Input.dispatchKeyEvent', {
                 type: 'keyDown', key: 'Enter', code: 'Enter', text: '\r',
@@ -1918,7 +2317,16 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
             await cdpSend(page, 'Input.dispatchKeyEvent', upParams);
         }
         await sleep(variableDelay(charDelayMs, char, i, text.length));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
     // Post-typing: detect and remove extra trailing brackets
     await removeTrailingBrackets(page);
     // Re-enable auto-formatting
@@ -1939,7 +2347,7 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
     console.log(`[browse] Typing complete (${text.length} chars)`);
 }
 /** Insert text into a generic input — click focus + char-by-char typing. */
-async function insertIntoGenericInput(page, el, text, charDelayMs) {
+async function insertIntoGenericInput(page, el, text, charDelayMs, guard) {
     await cdpSend(page, 'Input.dispatchMouseEvent', {
         type: 'mousePressed', x: el.x, y: el.y, button: 'left', clickCount: 1,
     });
@@ -1949,8 +2357,12 @@ async function insertIntoGenericInput(page, el, text, charDelayMs) {
     await sleep(200);
     await clearEditor(page);
     await sleep(200);
+    if (guard)
+        await guard.arm({ isCodeEditor: false });
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
+        if (guard)
+            await guard.markOwn(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         if (char === '\n') {
             await cdpSend(page, 'Input.dispatchKeyEvent', {
                 type: 'keyDown', key: 'Enter', code: 'Enter', text: '\r',
@@ -1988,7 +2400,16 @@ async function insertIntoGenericInput(page, el, text, charDelayMs) {
             await cdpSend(page, 'Input.dispatchKeyEvent', upParams);
         }
         await sleep(variableDelay(charDelayMs, char, i, text.length));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
 }
 /**
  * Extract page context for the LLM: title, URL, headings, errors, editor content.
@@ -2340,7 +2761,11 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
         for (const el of els) {
             const checked = el.checked ? ' [CHECKED]' : '';
             const visibility = el.inViewport ? '' : ' [OFF-SCREEN]';
-            lines.push(`  ${el.i}: [${el.type || el.tag}] "${el.text}"${checked}${visibility}`);
+            const skipNote = el.fieldKey && skippedFields.has(el.fieldKey)
+                ? ` [SKIPPED: ${skippedFields.get(el.fieldKey).note}]`
+                : '';
+            const personal = el.typable ? (0, personal_fields_1.promptMarker)(classificationOf(el)) : '';
+            lines.push(`  ${el.i}: [${el.type || el.tag}] "${el.text}"${checked}${visibility}${personal}${skipNote}`);
         }
         lines.push('');
     }
@@ -2352,7 +2777,7 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
     const body = {
         model,
         messages: [
-            { role: 'system', content: SYSTEM_PROMPT },
+            { role: 'system', content: SYSTEM_PROMPT + PERSONAL_SAFETY_RULES },
             {
                 role: 'user',
                 content: [
@@ -2362,11 +2787,19 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
             },
         ],
         temperature: 0.1,
-        max_tokens: 16384,
+        max_tokens: 2048,
         stream: false,
     };
     const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    // Distinguish a genuine timeout from the heartbeat cancelling a stale request
+    // because the page changed: they need opposite handling (backoff vs re-analyze
+    // now). The old code reported both as "timed out (300s)" and backed off 30s+,
+    // which livelocked on dynamic pages.
+    let abortReason = null;
+    const timeout = setTimeout(() => {
+        abortReason = 'timeout';
+        controller.abort();
+    }, timeoutMs);
     // Heartbeat: check for screen changes every 5s, abort LLM if page changed
     const heartbeat = setInterval(async () => {
         const elapsed = Math.round((Date.now() - startTime) / 1000);
@@ -2412,6 +2845,7 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
                 const changeScore = calculateChangeScore(lastFingerprint, freshFingerprint);
                 if (changeScore >= 15) {
                     console.log(`[browse] Fingerprint confirms change (score: ${changeScore}) — aborting LLM (${elapsed}s)`);
+                    abortReason = 'screen_change';
                     controller.abort();
                     return;
                 }
@@ -2478,6 +2912,13 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
     }
     catch (err) {
         if (err instanceof Error && err.name === 'AbortError') {
+            const elapsed = Math.round((Date.now() - startTime) / 1000);
+            if (abortReason === 'screen_change') {
+                // The page changed while we were waiting: the answer is already stale.
+                // Signal the caller to re-analyze right away (no backoff).
+                console.log(`[browse] LLM aborted at ${elapsed}s — screen changed, re-analyzing now`);
+                return { actions: [], attempt, durationMs: Date.now() - startTime, error: 'screen_changed' };
+            }
             console.error(`[browse] LLM request timed out (${Math.round(timeoutMs / 1000)}s)`);
             return { actions: [], attempt, durationMs: Date.now() - startTime, error: 'timeout' };
         }
@@ -2499,7 +2940,7 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
     const body = {
         model,
         messages: [
-            { role: 'system', content: customSystemPrompt },
+            { role: 'system', content: customSystemPrompt + PERSONAL_SAFETY_RULES },
             {
                 role: 'user',
                 content: [
@@ -2509,11 +2950,15 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
             },
         ],
         temperature: 0.1,
-        max_tokens: 16384,
+        max_tokens: 2048,
         stream: false,
     };
     const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let optAbortReason = null;
+    const timeout = setTimeout(() => {
+        optAbortReason = 'timeout';
+        controller.abort();
+    }, timeoutMs);
     // Heartbeat: check for screen changes every 5s, abort if page changed
     const heartbeat = setInterval(async () => {
         const elapsed = Math.round((Date.now() - startTime) / 1000);
@@ -2530,6 +2975,7 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
             const flagTs = flagResult?.result?.value;
             if (flagTs && flagTs > startTime) {
                 console.log(`[browse] DOM mutation detected in opt pass (${elapsed}s) — aborting`);
+                optAbortReason = 'screen_change';
                 controller.abort();
                 return;
             }
@@ -2573,7 +3019,12 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
     }
     catch (err) {
         if (err instanceof Error && err.name === 'AbortError') {
-            return { actions: [], attempt, durationMs: Date.now() - startTime, error: 'timeout' };
+            return {
+                actions: [],
+                attempt,
+                durationMs: Date.now() - startTime,
+                error: optAbortReason === 'screen_change' ? 'screen_changed' : 'timeout',
+            };
         }
         return { actions: [], attempt, durationMs: Date.now() - startTime, error: 'http_error' };
     }
@@ -2767,19 +3218,24 @@ function getAdjacentKey(char) {
  * Type text with human-like patterns: variable speed, occasional typos,
  * backspaces, natural pauses. Uses OS-level keyboard (no CDP).
  */
-async function typeHumanLike(text, baseDelayMs = 120) {
+async function typeHumanLike(text, baseDelayMs = 120, guard) {
+    const send = async (ch, keyName) => {
+        if (guard)
+            await guard.markOwn(ch, keyName);
+        typeCharOS(ch);
+    };
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
         // 1. Occasional typo (2% chance) — then backspace to correct
         if (char !== '\n' && char !== '\t' && Math.random() < 0.02) {
             const wrong = getAdjacentKey(char);
-            typeCharOS(wrong);
+            await send(wrong);
             await sleep(randomInt(40, 120));
-            typeCharOS('\b'); // backspace
+            await send('\b', 'Backspace'); // backspace
             await sleep(randomInt(25, 70));
         }
         // 2. Type the correct character
-        typeCharOS(char);
+        await send(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         // 3. Variable delay based on character type (human rhythm)
         let delay = baseDelayMs + randomInt(-Math.floor(baseDelayMs * 0.3), Math.floor(baseDelayMs * 0.4));
         if (char === ' ')
@@ -2801,7 +3257,16 @@ async function typeHumanLike(text, baseDelayMs = 120) {
             await sleep(randomInt(200, 600));
         }
         await sleep(Math.max(delay, 30));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
 }
 /**
  * Wait for the screen to change by comparing screenshots.
@@ -2864,7 +3329,7 @@ async function callStealthLLM(baseUrl, apiKey, model, screenshotPath, timeoutMs,
             body: JSON.stringify({
                 model,
                 messages: [
-                    { role: 'system', content: systemPrompt },
+                    { role: 'system', content: systemPrompt + PERSONAL_SAFETY_RULES },
                     {
                         role: 'user',
                         content: [
@@ -2961,9 +3426,41 @@ async function runStealthLoop(baseUrl, apiKey, model, maxActions, intervalMs, ti
                 }
                 case 'type': {
                     if (result.text && result.text.length > 0) {
+                        const guard = new human_input_guard_1.TypingGuard({
+                            enabled: fieldSafety.stopOnUserInput,
+                            osLevel: true,
+                            label: result.text.slice(0, 40),
+                        });
+                        // Stealth has no DOM: use the focused control's own name as the
+                        // label for both the personal classifier and the human-skip list.
+                        const control = await guard.currentOsControl().catch(() => null);
+                        if (control) {
+                            if (control.signature && skippedOsFields.has(control.signature)) {
+                                console.log(`[stealth] Skipping field - ${skippedOsFields.get(control.signature)}`);
+                                actionCount++;
+                                break;
+                            }
+                            if (control.name && fieldSafety.allowPersonal === false) {
+                                const cls = (0, personal_fields_1.classifyField)({ label: control.name, ariaLabel: control.name });
+                                if ((0, personal_fields_1.isBlocked)(cls, { allowPersonal: fieldSafety.allowPersonal })) {
+                                    skippedOsFields.set(control.signature, `left to you (${cls.category}: "${control.name.slice(0, 60)}")`);
+                                    console.log(`[stealth] Not answering a personal question - left to you (${cls.category}: "${control.name.slice(0, 60)}")`);
+                                    actionCount++;
+                                    break;
+                                }
+                            }
+                        }
                         console.log(`[stealth] Typing ${result.text.length} chars...`);
                         await sleep(randomInt(300, 700)); // natural pause before typing
-                        await typeHumanLike(result.text, charDelayMs);
+                        await guard.arm({ isCodeEditor: false });
+                        await typeHumanLike(result.text, charDelayMs, guard);
+                        if (guard.stopped) {
+                            const after = await guard.currentOsControl().catch(() => null);
+                            const sig = after?.signature || control?.signature;
+                            if (sig)
+                                skippedOsFields.set(sig, `you answered this one yourself (${guard.describeStop()})`);
+                            console.log(`[stealth] Stopped typing - you answered this one yourself (${guard.describeStop()})`);
+                        }
                         actionCount++;
                     }
                     else {