teamshare-bridge 0.21.26 → 0.21.27

package/dist/cli/commands/browse.js

@@ -59,6 +59,8 @@ const child_process_1 = require("child_process");
 const cdp_1 = require("../../lib/browser/cdp");
 const launch_1 = require("../../lib/browser/launch");
 const session_1 = require("../../lib/browser/session");
+const personal_fields_1 = require("../../lib/browser/personal-fields");
+const human_input_guard_1 = require("../../lib/browser/human-input-guard");
 /** Create a fingerprint from the current element list. */
 function createFingerprint(elements) {
     const groups = new Map();
@@ -239,10 +241,10 @@ CORRECTION MODE:
 - If you previously typed wrong code, use write_code to replace with correct code
 - You may be asked the same question multiple times — each time, check if the current answer is correct before acting
 
-PERSONAL QUESTIONS — SKIP THEM:
-- NEVER type answers for questions asking: name, email, phone, address, SSN, password, credit card, date of birth, or any personal information
-- If a question asks for personal info, do NOT click or type — skip it entirely
-- If ALL remaining questions are personal, return done
+PERSONAL QUESTIONS — NEVER ANSWER THEM:
+- Questions about the person operating the browser (name, email, phone, address, SSN, passport, password, card, bank, date of birth, salary, work authorization, personal profile links) are OFF LIMITS. Read the PERSONAL QUESTIONS addendum appended below and follow it exactly.
+- If a question asks for personal info, do NOT click or type — leave it empty.
+- A personal field left empty is NOT an unanswered question. If ALL remaining questions are personal, return done immediately.
 
 RESPONSE FORMAT RULES (CRITICAL — follow exactly):
 - Return ONLY a valid JSON array. No explanations, no markdown fences, no extra text.
@@ -462,6 +464,15 @@ async function cmdBrowse(flags) {
     const stealth = flags.has('stealth');
     const hybrid = flags.has('hybrid');
     const autoLaunch = flags.has('auto-launch');
+    // Field safety (see personal-fields.ts / human-input-guard.ts):
+    //   --stop-on-user-input   opt-in: stop typing and skip the field for the run
+    //                          as soon as the human types into it
+    //   --personal-questions   "allow" answers personal questions; credentials and
+    //                          card/bank fields stay blocked either way
+    const stopOnUserInput = flags.has('stop-on-user-input') && flags.get('stop-on-user-input') !== 'false';
+    const personalMode = (flags.get('personal-questions') ?? 'skip').toLowerCase();
+    fieldSafety.stopOnUserInput = stopOnUserInput;
+    fieldSafety.allowPersonal = personalMode === 'allow';
     // The auto-answer browser is ALWAYS visible (2026-09): a headless window is
     // the "profile seems mismatched" case and hides the pages the loop works on.
     // `--headless` is accepted for backward compatibility but ignored.
@@ -493,6 +504,8 @@ async function cmdBrowse(flags) {
     }
     console.log(`[browse] Char delay: ${charDelayMs}ms`);
     console.log(`[browse] Screenshot interval: ${intervalMs}ms`);
+    console.log(`[browse] Personal questions: ${fieldSafety.allowPersonal ? 'answered (credentials still blocked)' : 'never answered (left for you)'}`);
+    console.log(`[browse] Stop typing when you type in the field: ${fieldSafety.stopOnUserInput ? 'on' : 'off'}`);
     if (!stealth) {
         console.log(`[browse] Max consecutive failures: ${maxConsecutiveFailures === 0 ? 'unlimited' : maxConsecutiveFailures}`);
     }
@@ -826,6 +839,18 @@ async function cmdBrowse(flags) {
                     console.log(`[browse] Skipping ${act.action} — code already confirmed optimal`);
                     continue;
                 }
+                // Field safety: never type into a personal field, a credential field, or
+                // a field the human already answered themselves.
+                if (act.action === 'write_code' || act.action === 'type') {
+                    const targetEl = act.elementIndex !== undefined
+                        ? elements.find((e) => e.i === act.elementIndex)
+                        : undefined;
+                    const gated = fieldGate(targetEl);
+                    if (gated) {
+                        console.log(`[browse] Skipping element ${act.elementIndex} - ${gated}`);
+                        continue;
+                    }
+                }
                 // Ask LLM to decide if action is redundant
                 const redundancy = await isActionRedundant(baseUrl, apiKey, model, page, elements, act, timeoutMs);
                 if (redundancy.decision === 'skip') {
@@ -1017,6 +1042,14 @@ Do NOT simplify variable names or change the function signature. Only optimize t
         console.log(`[browse] Reached max actions (${maxActions})`);
     }
     console.log(`[browse] Agent finished. ${actionCount} actions performed.`);
+    const skipped = personalSkipSummary();
+    if (skipped.personal > 0 || skipped.human > 0) {
+        console.log(`[browse] Left for you: ${skipped.personal} personal question(s) never answered` +
+            (skipped.human > 0 ? `, ${skipped.human} field(s) you answered yourself` : ''));
+        for (const entry of skippedFields.values()) {
+            console.log(`  - ${entry.note}`);
+        }
+    }
     page.ws.close();
 }
 // ── CDP Helpers ──────────────────────────────────────────────────────────────
@@ -1184,6 +1217,124 @@ async function captureScreenshot(page, quality, maxEdge = 0) {
         return null;
     }
 }
+/**
+ * Field-safety addendum appended to every system prompt (main loop, custom /
+ * optimization passes, stealth loop). The loop may not answer questions that
+ * ask about the human behind the browser.
+ */
+const PERSONAL_SAFETY_RULES = `
+PERSONAL QUESTIONS - NEVER ANSWER THEM:
+- Some questions ask about YOU (the human operating the browser), not about the
+  task. NEVER answer them with an invented value.
+- Never type: names, email addresses, phone numbers, postal addresses, dates of
+  birth or age, government IDs (SSN/NIN/passport/driving licence/tax id),
+  passwords, one-time codes, card or bank details, salary or compensation,
+  notice periods, work-authorization/visa/sponsorship answers, or personal
+  profile links (LinkedIn, GitHub, portfolio, personal website).
+- Fields marked "[NEVER ANSWER: ...]" or "[PERSONAL: ...]" in the element list
+  MUST be left untouched - do not click them, do not type into them.
+- Leaving a personal field EMPTY is correct and expected. A personal field is
+  NOT an unanswered question: never treat it as one, and never delay "done"
+  because of it.
+- If every remaining question is personal, return done.
+- Demographics and free-text personal questions (gender, marital status, "tell
+  us about yourself") are the human's to answer: prefer to skip them too.
+`;
+const fieldSafety = {
+    stopOnUserInput: false,
+    allowPersonal: false,
+};
+/** fieldKey -> why the field must not be typed into for the rest of the run. */
+const skippedFields = new Map();
+/**
+ * Stealth mode has no DOM, so fields are identified by the focused OS control
+ * (AutomationId|ClassName|Name) instead of a field key.
+ */
+const skippedOsFields = new Map();
+function signalsOf(el) {
+    return {
+        tag: el.tag,
+        type: el.type,
+        name: el.name,
+        id: el.id,
+        autocomplete: el.autocomplete,
+        placeholder: el.placeholder,
+        ariaLabel: el.ariaLabel,
+        label: el.label,
+        questionText: el.questionText,
+        text: el.text,
+    };
+}
+function classificationOf(el) {
+    return {
+        tier: el.personalTier ?? null,
+        category: el.personalCategory ?? null,
+        label: el.personalLabel ?? '',
+        reason: el.personalReason ?? '',
+    };
+}
+/**
+ * Classify every typable element and stamp its stable field key. Elements are
+ * annotated in place so the gate below never re-parses the DOM.
+ */
+function annotateFieldSafety(elements) {
+    for (const el of elements) {
+        const signals = signalsOf(el);
+        el.fieldKey = (0, personal_fields_1.fieldKeyOf)(signals);
+        if (!el.typable)
+            continue;
+        const cls = (0, personal_fields_1.classifyField)(signals);
+        el.personalTier = cls.tier;
+        el.personalCategory = cls.category;
+        el.personalLabel = cls.label;
+        el.personalReason = cls.reason;
+    }
+}
+function shortLabel(el) {
+    const raw = el.label || el.questionText || el.text || el.placeholder || el.name || '';
+    return raw.replace(/\s+/g, ' ').trim().slice(0, 60);
+}
+/**
+ * Returns a human-readable reason when this element must not be typed into,
+ * or null when it is fine to type.
+ */
+function fieldGate(el) {
+    if (!el || !el.typable)
+        return null;
+    const key = el.fieldKey ?? (0, personal_fields_1.fieldKeyOf)(signalsOf(el));
+    const already = skippedFields.get(key);
+    if (already)
+        return already.note;
+    const cls = classificationOf(el);
+    if (cls.tier === null)
+        return null;
+    if (!(0, personal_fields_1.isBlocked)(cls, { allowPersonal: fieldSafety.allowPersonal }))
+        return null;
+    const note = `left to you (${cls.category}: "${shortLabel(el) || cls.label}")`;
+    skippedFields.set(key, { kind: 'personal', note });
+    console.log(`[browse] Not answering a personal question - ${note}`);
+    return note;
+}
+/** Record a field the human took over mid-typing; it is never typed again. */
+function noteHumanTookOver(el, reason) {
+    const key = el?.fieldKey ?? (el ? (0, personal_fields_1.fieldKeyOf)(signalsOf(el)) : '');
+    if (!key)
+        return;
+    const note = `you answered this one yourself (${reason})`;
+    skippedFields.set(key, { kind: 'human', note });
+    console.log(`[browse] Stopped typing - ${note}`);
+}
+function personalSkipSummary() {
+    let personal = 0;
+    let human = 0;
+    for (const entry of skippedFields.values()) {
+        if (entry.kind === 'personal')
+            personal++;
+        else
+            human++;
+    }
+    return { personal, human };
+}
 /**
  * Extract all interactive elements from the DOM with their exact text,
  * bounding boxes, state, and question group assignments.
@@ -1224,6 +1375,29 @@ async function extractElements(page) {
           text,
           tag: el.tagName.toLowerCase(),
           type: el.type || el.getAttribute('role') || '',
+          typable: el.tagName === 'INPUT' || el.tagName === 'TEXTAREA' || el.isContentEditable === true,
+          name: el.getAttribute('name') || '',
+          id: el.getAttribute('id') || '',
+          autocomplete: el.getAttribute('autocomplete') || '',
+          placeholder: el.getAttribute('placeholder') || '',
+          ariaLabel: el.getAttribute('aria-label') || '',
+          label: (() => {
+            try {
+              const id = el.getAttribute('id');
+              if (id) {
+                const forLabel = document.querySelector('label[for="' + CSS.escape(id) + '"]');
+                if (forLabel && forLabel.innerText) return forLabel.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              }
+              const wrap = el.closest ? el.closest('label') : null;
+              if (wrap && wrap.innerText) return wrap.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              const labelled = el.getAttribute('aria-labelledby');
+              if (labelled) {
+                const t = document.getElementById(labelled);
+                if (t && t.innerText) return t.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              }
+            } catch (err) {}
+            return '';
+          })(),
           checked: el.checked || el.getAttribute('aria-checked') === 'true' || false,
           x: Math.round(rect.x + rect.width / 2),
           y: Math.round(rect.y + rect.height / 2),
@@ -1336,6 +1510,13 @@ async function extractElements(page) {
           y: item.y,
           group: item.groupId,
           inViewport: item.inViewport,
+          typable: item.typable,
+          name: item.name,
+          id: item.id,
+          autocomplete: item.autocomplete,
+          placeholder: item.placeholder,
+          ariaLabel: item.ariaLabel,
+          label: item.label,
         });
       });
 
@@ -1344,7 +1525,9 @@ async function extractElements(page) {
   `;
     try {
         const result = await cdpEval(page, js);
-        return result?.result?.value || [];
+        const elements = result?.result?.value || [];
+        annotateFieldSafety(elements);
+        return elements;
     }
     catch {
         return [];
@@ -1393,6 +1576,11 @@ async function executeAction(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 // 1. Detect editor type
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
@@ -1407,12 +1595,19 @@ async function executeAction(page, act, elements, charDelayMs) {
                 // 3. Normalize indentation for code editors (LLM often adds extra indent)
                 const text = isCodeEditor ? normalizeCodeIndent(rawText) : rawText;
                 console.log(`[browse] Typing ${text.length} characters...`);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
                 if (isCodeEditor) {
-                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs);
+                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs, guard);
                 }
                 else {
-                    await insertIntoGenericInput(page, el, text, charDelayMs);
+                    await insertIntoGenericInput(page, el, text, charDelayMs, guard);
                 }
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'write_code': {
@@ -1423,6 +1618,11 @@ async function executeAction(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 // 1. Detect editor type
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
@@ -1435,13 +1635,20 @@ async function executeAction(page, act, elements, charDelayMs) {
                     .replace(/\\"/g, '"')
                     .replace(/\\\\/g, '\\');
                 console.log(`[browse] Writing code (${text.length} chars)...`);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
                 // 3. write_code inserts EXACTLY as-is — no normalizeCodeIndent
                 if (isCodeEditor) {
-                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs);
+                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs, guard);
                 }
                 else {
-                    await insertIntoGenericInput(page, el, text, charDelayMs);
+                    await insertIntoGenericInput(page, el, text, charDelayMs, guard);
                 }
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'scroll': {
@@ -1515,6 +1722,11 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
                 if (editor)
@@ -1533,7 +1745,16 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     pressKeyOS('ctrl+a');
                     await sleep(randomInt(50, 100));
                 }
-                await typeHumanLike(text, charDelayMs);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
+                if (guard)
+                    await guard.arm({ isCodeEditor });
+                await typeHumanLike(text, charDelayMs, guard);
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'write_code': {
@@ -1544,6 +1765,11 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
                 if (editor)
@@ -1561,7 +1787,16 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     pressKeyOS('ctrl+a');
                     await sleep(randomInt(50, 100));
                 }
-                await typeHumanLike(text, charDelayMs);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
+                if (guard)
+                    await guard.arm({ isCodeEditor });
+                await typeHumanLike(text, charDelayMs, guard);
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'scroll': {
@@ -1748,13 +1983,21 @@ function hasUnansweredQuestions(elements) {
         const types = els.map((e) => e.type);
         const isRadio = types.some((t) => t === 'radio');
         const isCheckbox = types.some((t) => t === 'checkbox');
-        const hasInput = els.some((e) => e.tag === 'input' || e.tag === 'textarea');
+        // Personal fields are the human's to answer: they are never "unanswered"
+        // for the agent, so a `done` from the model with them left empty sticks
+        // instead of triggering the "you must answer everything" retry loop.
+        const inputs = els.filter((e) => (e.tag === 'input' || e.tag === 'textarea') &&
+            e.type !== 'radio' &&
+            e.type !== 'checkbox' &&
+            e.typable !== false);
+        const openInputs = inputs.filter((e) => !(0, personal_fields_1.excludesFromCompleteness)(classificationOf(e)));
+        const hasInput = openInputs.length > 0;
         const checkedCount = els.filter((e) => e.checked).length;
         if (isRadio && checkedCount === 0)
             return true;
         if (isCheckbox && checkedCount < els.length)
             return true;
-        if (hasInput && !els.some((e) => e.text && e.tag === 'input'))
+        if (hasInput && !openInputs.some((e) => e.text && e.tag === 'input'))
             return true;
     }
     return false;
@@ -1979,7 +2222,7 @@ async function removeTrailingBrackets(page) {
     console.log(`[browse] Removed ${extra} extra trailing bracket(s)`);
 }
 /** Insert text into ANY code editor — character-by-character typing, no pasting. */
-async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
+async function insertIntoCodeEditor(page, selector, text, charDelayMs, guard) {
     // Focus the editor
     await focusSelector(page, selector);
     await sleep(100);
@@ -2031,8 +2274,12 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
     // Type character by character — NO pasting
     const est = Math.round(text.length * charDelayMs / 1000);
     console.log(`[browse] Typing ${text.length} chars (~${est}s est.)...`);
+    if (guard)
+        await guard.arm({ selector, isCodeEditor: true });
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
+        if (guard)
+            await guard.markOwn(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         if (char === '\n') {
             await cdpSend(page, 'Input.dispatchKeyEvent', {
                 type: 'keyDown', key: 'Enter', code: 'Enter', text: '\r',
@@ -2070,7 +2317,16 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
             await cdpSend(page, 'Input.dispatchKeyEvent', upParams);
         }
         await sleep(variableDelay(charDelayMs, char, i, text.length));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
     // Post-typing: detect and remove extra trailing brackets
     await removeTrailingBrackets(page);
     // Re-enable auto-formatting
@@ -2091,7 +2347,7 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
     console.log(`[browse] Typing complete (${text.length} chars)`);
 }
 /** Insert text into a generic input — click focus + char-by-char typing. */
-async function insertIntoGenericInput(page, el, text, charDelayMs) {
+async function insertIntoGenericInput(page, el, text, charDelayMs, guard) {
     await cdpSend(page, 'Input.dispatchMouseEvent', {
         type: 'mousePressed', x: el.x, y: el.y, button: 'left', clickCount: 1,
     });
@@ -2101,8 +2357,12 @@ async function insertIntoGenericInput(page, el, text, charDelayMs) {
     await sleep(200);
     await clearEditor(page);
     await sleep(200);
+    if (guard)
+        await guard.arm({ isCodeEditor: false });
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
+        if (guard)
+            await guard.markOwn(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         if (char === '\n') {
             await cdpSend(page, 'Input.dispatchKeyEvent', {
                 type: 'keyDown', key: 'Enter', code: 'Enter', text: '\r',
@@ -2140,7 +2400,16 @@ async function insertIntoGenericInput(page, el, text, charDelayMs) {
             await cdpSend(page, 'Input.dispatchKeyEvent', upParams);
         }
         await sleep(variableDelay(charDelayMs, char, i, text.length));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
 }
 /**
  * Extract page context for the LLM: title, URL, headings, errors, editor content.
@@ -2492,7 +2761,11 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
         for (const el of els) {
             const checked = el.checked ? ' [CHECKED]' : '';
             const visibility = el.inViewport ? '' : ' [OFF-SCREEN]';
-            lines.push(`  ${el.i}: [${el.type || el.tag}] "${el.text}"${checked}${visibility}`);
+            const skipNote = el.fieldKey && skippedFields.has(el.fieldKey)
+                ? ` [SKIPPED: ${skippedFields.get(el.fieldKey).note}]`
+                : '';
+            const personal = el.typable ? (0, personal_fields_1.promptMarker)(classificationOf(el)) : '';
+            lines.push(`  ${el.i}: [${el.type || el.tag}] "${el.text}"${checked}${visibility}${personal}${skipNote}`);
         }
         lines.push('');
     }
@@ -2504,7 +2777,7 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
     const body = {
         model,
         messages: [
-            { role: 'system', content: SYSTEM_PROMPT },
+            { role: 'system', content: SYSTEM_PROMPT + PERSONAL_SAFETY_RULES },
             {
                 role: 'user',
                 content: [
@@ -2667,7 +2940,7 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
     const body = {
         model,
         messages: [
-            { role: 'system', content: customSystemPrompt },
+            { role: 'system', content: customSystemPrompt + PERSONAL_SAFETY_RULES },
             {
                 role: 'user',
                 content: [
@@ -2945,19 +3218,24 @@ function getAdjacentKey(char) {
  * Type text with human-like patterns: variable speed, occasional typos,
  * backspaces, natural pauses. Uses OS-level keyboard (no CDP).
  */
-async function typeHumanLike(text, baseDelayMs = 120) {
+async function typeHumanLike(text, baseDelayMs = 120, guard) {
+    const send = async (ch, keyName) => {
+        if (guard)
+            await guard.markOwn(ch, keyName);
+        typeCharOS(ch);
+    };
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
         // 1. Occasional typo (2% chance) — then backspace to correct
         if (char !== '\n' && char !== '\t' && Math.random() < 0.02) {
             const wrong = getAdjacentKey(char);
-            typeCharOS(wrong);
+            await send(wrong);
             await sleep(randomInt(40, 120));
-            typeCharOS('\b'); // backspace
+            await send('\b', 'Backspace'); // backspace
             await sleep(randomInt(25, 70));
         }
         // 2. Type the correct character
-        typeCharOS(char);
+        await send(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         // 3. Variable delay based on character type (human rhythm)
         let delay = baseDelayMs + randomInt(-Math.floor(baseDelayMs * 0.3), Math.floor(baseDelayMs * 0.4));
         if (char === ' ')
@@ -2979,7 +3257,16 @@ async function typeHumanLike(text, baseDelayMs = 120) {
             await sleep(randomInt(200, 600));
         }
         await sleep(Math.max(delay, 30));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
 }
 /**
  * Wait for the screen to change by comparing screenshots.
@@ -3042,7 +3329,7 @@ async function callStealthLLM(baseUrl, apiKey, model, screenshotPath, timeoutMs,
             body: JSON.stringify({
                 model,
                 messages: [
-                    { role: 'system', content: systemPrompt },
+                    { role: 'system', content: systemPrompt + PERSONAL_SAFETY_RULES },
                     {
                         role: 'user',
                         content: [
@@ -3139,9 +3426,41 @@ async function runStealthLoop(baseUrl, apiKey, model, maxActions, intervalMs, ti
                 }
                 case 'type': {
                     if (result.text && result.text.length > 0) {
+                        const guard = new human_input_guard_1.TypingGuard({
+                            enabled: fieldSafety.stopOnUserInput,
+                            osLevel: true,
+                            label: result.text.slice(0, 40),
+                        });
+                        // Stealth has no DOM: use the focused control's own name as the
+                        // label for both the personal classifier and the human-skip list.
+                        const control = await guard.currentOsControl().catch(() => null);
+                        if (control) {
+                            if (control.signature && skippedOsFields.has(control.signature)) {
+                                console.log(`[stealth] Skipping field - ${skippedOsFields.get(control.signature)}`);
+                                actionCount++;
+                                break;
+                            }
+                            if (control.name && fieldSafety.allowPersonal === false) {
+                                const cls = (0, personal_fields_1.classifyField)({ label: control.name, ariaLabel: control.name });
+                                if ((0, personal_fields_1.isBlocked)(cls, { allowPersonal: fieldSafety.allowPersonal })) {
+                                    skippedOsFields.set(control.signature, `left to you (${cls.category}: "${control.name.slice(0, 60)}")`);
+                                    console.log(`[stealth] Not answering a personal question - left to you (${cls.category}: "${control.name.slice(0, 60)}")`);
+                                    actionCount++;
+                                    break;
+                                }
+                            }
+                        }
                         console.log(`[stealth] Typing ${result.text.length} chars...`);
                         await sleep(randomInt(300, 700)); // natural pause before typing
-                        await typeHumanLike(result.text, charDelayMs);
+                        await guard.arm({ isCodeEditor: false });
+                        await typeHumanLike(result.text, charDelayMs, guard);
+                        if (guard.stopped) {
+                            const after = await guard.currentOsControl().catch(() => null);
+                            const sig = after?.signature || control?.signature;
+                            if (sig)
+                                skippedOsFields.set(sig, `you answered this one yourself (${guard.describeStop()})`);
+                            console.log(`[stealth] Stopped typing - you answered this one yourself (${guard.describeStop()})`);
+                        }
                         actionCount++;
                     }
                     else {