teamshare-bridge 0.21.26 → 0.21.28

package/dist/cli/commands/browse.js

@@ -59,6 +59,8 @@ const child_process_1 = require("child_process");
 const cdp_1 = require("../../lib/browser/cdp");
 const launch_1 = require("../../lib/browser/launch");
 const session_1 = require("../../lib/browser/session");
+const personal_fields_1 = require("../../lib/browser/personal-fields");
+const human_input_guard_1 = require("../../lib/browser/human-input-guard");
 /** Create a fingerprint from the current element list. */
 function createFingerprint(elements) {
     const groups = new Map();
@@ -114,12 +116,25 @@ function calculateChangeScore(prev, curr) {
     }
     return score;
 }
+/** Fast path (easy objective questions): small reasoning budget. */
+const FAST_MAX_TOKENS = 2048;
+/** Deep path (hard coding questions): enough tokens to emit a full solution. */
+const DEEP_MAX_TOKENS = 16384;
+/** Attempt-1 ceiling: abandon a slow easy answer and escalate to the deep path. */
+const FAST_ATTEMPT_TIMEOUT_MS = 45_000;
+/**
+ * Rule 0 is swapped per attempt: the fast path forbids long deliberation, the
+ * deep path (entered when the fast attempt fails) explicitly allows it so hard
+ * coding questions get reasoned/complete answers.
+ */
+const FAST_RULE_0 = '0. BE FAST AND DECISIVE. Answer in a single pass with minimal reasoning - do NOT deliberate at length, re-check repeatedly, or restate the page. Emit the final JSON array as your primary output. Speed matters more than exhaustive deliberation.';
+const DEEP_RULE_0 = '0. This may be a HARD problem (advanced coding / algorithms). Reason carefully before acting; correctness and efficiency matter more than speed. For coding questions, write the most time-efficient solution and emit the FULL solution via write_code.';
 const SYSTEM_PROMPT = `You are a browser automation agent. A screenshot and a grouped list of interactive elements are attached.
 
 Your task: identify unanswered questions and answer them by clicking the correct elements.
 
 RULES (STRICT):
-0. BE FAST AND DECISIVE. Answer in a single pass with minimal reasoning — do NOT deliberate at length, re-check repeatedly, or restate the page. Emit the final JSON array as your primary output. Speed matters more than exhaustive deliberation.
+${FAST_RULE_0}
 1. NEVER click Next, Submit, Back, Save, Continue, or any navigation. ONLY answer questions on the current screen.
 2. NEVER ask for help. If uncertain, pick the BEST GUESS. Always decide — never wait.
 3. Handle MULTIPLE unanswered questions in a SINGLE response.
@@ -239,10 +254,10 @@ CORRECTION MODE:
 - If you previously typed wrong code, use write_code to replace with correct code
 - You may be asked the same question multiple times — each time, check if the current answer is correct before acting
 
-PERSONAL QUESTIONS — SKIP THEM:
-- NEVER type answers for questions asking: name, email, phone, address, SSN, password, credit card, date of birth, or any personal information
-- If a question asks for personal info, do NOT click or type — skip it entirely
-- If ALL remaining questions are personal, return done
+PERSONAL QUESTIONS — NEVER ANSWER THEM:
+- Questions about the person operating the browser (name, email, phone, address, SSN, passport, password, card, bank, date of birth, salary, work authorization, personal profile links) are OFF LIMITS. Read the PERSONAL QUESTIONS addendum appended below and follow it exactly.
+- If a question asks for personal info, do NOT click or type — leave it empty.
+- A personal field left empty is NOT an unanswered question. If ALL remaining questions are personal, return done immediately.
 
 RESPONSE FORMAT RULES (CRITICAL — follow exactly):
 - Return ONLY a valid JSON array. No explanations, no markdown fences, no extra text.
@@ -444,16 +459,16 @@ async function cmdBrowse(flags) {
     const maxActions = continuous ? Number.MAX_SAFE_INTEGER : parseInt(flags.get('max-actions') ?? '50', 10);
     const intervalMs = parseInt(flags.get('interval') ?? '2000', 10);
     const modelSpec = flags.get('model') ?? models_1.DEFAULT_VISION_MODEL;
-    // Target: a decisive answer in well under a minute. 60s is the abandon
-    // threshold (overridable); the fast abort + short retry below makes giving up
-    // cheap, so we never wait 5 minutes for a stale decision.
-    const timeoutSec = Math.min(Math.max(parseInt(flags.get('timeout') ?? '60', 10), 20), 600);
+    // Hard problems (advanced coding) need time; easy objective questions must
+    // not pay for it. 300s is the ceiling for a single decision (overridable);
+    // the fast retry below abandons a slow easy answer at ~45s and escalates.
+    const timeoutSec = Math.min(Math.max(parseInt(flags.get('timeout') ?? '300', 10), 30), 600);
     const timeoutMs = timeoutSec * 1000;
     const quality = Math.min(Math.max(parseInt(flags.get('quality') ?? '70', 10), 50), 100);
     /**
-     * Downscale the screenshot when the viewport is bigger than this many px on
-     * its longest side (fewer image tokens => faster vision response on big
-     * pages; a 1440px page produced 100KB+ images that blew the timeout).
+     * Downscale the FAST-path screenshot (attempt 1) to keep easy questions
+     * quick. The deep retry re-captures at full resolution so code/text stays
+     * legible. Clicks are unaffected either way (actions use element coords).
      */
     const SCREENSHOT_MAX_EDGE = 1024;
     const maxConsecutiveFailures = parseInt(flags.get('max-consecutive-failures') ?? '0', 10); // 0 = unlimited
@@ -462,6 +477,15 @@ async function cmdBrowse(flags) {
     const stealth = flags.has('stealth');
     const hybrid = flags.has('hybrid');
     const autoLaunch = flags.has('auto-launch');
+    // Field safety (see personal-fields.ts / human-input-guard.ts):
+    //   --stop-on-user-input   opt-in: stop typing and skip the field for the run
+    //                          as soon as the human types into it
+    //   --personal-questions   "allow" answers personal questions; credentials and
+    //                          card/bank fields stay blocked either way
+    const stopOnUserInput = flags.has('stop-on-user-input') && flags.get('stop-on-user-input') !== 'false';
+    const personalMode = (flags.get('personal-questions') ?? 'skip').toLowerCase();
+    fieldSafety.stopOnUserInput = stopOnUserInput;
+    fieldSafety.allowPersonal = personalMode === 'allow';
     // The auto-answer browser is ALWAYS visible (2026-09): a headless window is
     // the "profile seems mismatched" case and hides the pages the loop works on.
     // `--headless` is accepted for backward compatibility but ignored.
@@ -493,6 +517,8 @@ async function cmdBrowse(flags) {
     }
     console.log(`[browse] Char delay: ${charDelayMs}ms`);
     console.log(`[browse] Screenshot interval: ${intervalMs}ms`);
+    console.log(`[browse] Personal questions: ${fieldSafety.allowPersonal ? 'answered (credentials still blocked)' : 'never answered (left for you)'}`);
+    console.log(`[browse] Stop typing when you type in the field: ${fieldSafety.stopOnUserInput ? 'on' : 'off'}`);
     if (!stealth) {
         console.log(`[browse] Max consecutive failures: ${maxConsecutiveFailures === 0 ? 'unlimited' : maxConsecutiveFailures}`);
     }
@@ -676,7 +702,20 @@ async function cmdBrowse(flags) {
             /** The page changed under the LLM: re-analyze immediately, no backoff. */
             let screenChangedDuringLlm = false;
             for (let attempt = 1; attempt <= maxRetries; attempt++) {
-                result = await analyzeScreenshot(baseUrl, apiKey, model, screenshot, elements, pageContext, timeoutMs, attempt, maxRetries, page, lastFingerprint);
+                // Fast-first ladder: attempt 1 uses a small budget + downscaled shot so
+                // easy objective questions answer quickly. If it fails, attempts 2+
+                // switch to the DEEP budget (full timeout + tokens, full-res capture)
+                // for hard coding questions. `max_tokens`/timeout are ceilings, so the
+                // deep path never slows a question that answers on the fast path.
+                const deep = attempt > 1;
+                const attemptTimeoutMs = deep ? timeoutMs : Math.min(FAST_ATTEMPT_TIMEOUT_MS, timeoutMs);
+                if (deep && attempt === 2) {
+                    console.log('[browse] Fast attempt did not answer — escalating to the deep budget (more time + tokens)');
+                }
+                const attemptShot = deep
+                    ? ((await captureScreenshot(page, quality)) ?? screenshot)
+                    : screenshot;
+                result = await analyzeScreenshot(baseUrl, apiKey, model, attemptShot, elements, pageContext, attemptTimeoutMs, attempt, maxRetries, page, lastFingerprint, { maxTokens: deep ? DEEP_MAX_TOKENS : FAST_MAX_TOKENS, deep });
                 llmCallCount++;
                 llmStats.calls++;
                 llmStats.totalMs += result.durationMs;
@@ -780,7 +819,7 @@ async function cmdBrowse(flags) {
                     if (hasUnansweredQuestions(elements)) {
                         console.log(`[browse] LLM says done but unanswered questions remain — retrying...`);
                         // Force retry with stronger prompt
-                        result = await analyzeScreenshot(baseUrl, apiKey, model, screenshot, elements, pageContext, timeoutMs, 1, 1, page, lastFingerprint);
+                        result = await analyzeScreenshot(baseUrl, apiKey, model, screenshot, elements, pageContext, timeoutMs, 1, 1, page, lastFingerprint, { maxTokens: DEEP_MAX_TOKENS, deep: true });
                         if (result.actions.length > 0 && result.actions[0].action !== 'done') {
                             // LLM returned actual actions — re-process from the start of this loop
                             executedAny = false;
@@ -826,6 +865,18 @@ async function cmdBrowse(flags) {
                     console.log(`[browse] Skipping ${act.action} — code already confirmed optimal`);
                     continue;
                 }
+                // Field safety: never type into a personal field, a credential field, or
+                // a field the human already answered themselves.
+                if (act.action === 'write_code' || act.action === 'type') {
+                    const targetEl = act.elementIndex !== undefined
+                        ? elements.find((e) => e.i === act.elementIndex)
+                        : undefined;
+                    const gated = fieldGate(targetEl);
+                    if (gated) {
+                        console.log(`[browse] Skipping element ${act.elementIndex} - ${gated}`);
+                        continue;
+                    }
+                }
                 // Ask LLM to decide if action is redundant
                 const redundancy = await isActionRedundant(baseUrl, apiKey, model, page, elements, act, timeoutMs);
                 if (redundancy.decision === 'skip') {
@@ -1017,6 +1068,14 @@ Do NOT simplify variable names or change the function signature. Only optimize t
         console.log(`[browse] Reached max actions (${maxActions})`);
     }
     console.log(`[browse] Agent finished. ${actionCount} actions performed.`);
+    const skipped = personalSkipSummary();
+    if (skipped.personal > 0 || skipped.human > 0) {
+        console.log(`[browse] Left for you: ${skipped.personal} personal question(s) never answered` +
+            (skipped.human > 0 ? `, ${skipped.human} field(s) you answered yourself` : ''));
+        for (const entry of skippedFields.values()) {
+            console.log(`  - ${entry.note}`);
+        }
+    }
     page.ws.close();
 }
 // ── CDP Helpers ──────────────────────────────────────────────────────────────
@@ -1184,6 +1243,124 @@ async function captureScreenshot(page, quality, maxEdge = 0) {
         return null;
     }
 }
+/**
+ * Field-safety addendum appended to every system prompt (main loop, custom /
+ * optimization passes, stealth loop). The loop may not answer questions that
+ * ask about the human behind the browser.
+ */
+const PERSONAL_SAFETY_RULES = `
+PERSONAL QUESTIONS - NEVER ANSWER THEM:
+- Some questions ask about YOU (the human operating the browser), not about the
+  task. NEVER answer them with an invented value.
+- Never type: names, email addresses, phone numbers, postal addresses, dates of
+  birth or age, government IDs (SSN/NIN/passport/driving licence/tax id),
+  passwords, one-time codes, card or bank details, salary or compensation,
+  notice periods, work-authorization/visa/sponsorship answers, or personal
+  profile links (LinkedIn, GitHub, portfolio, personal website).
+- Fields marked "[NEVER ANSWER: ...]" or "[PERSONAL: ...]" in the element list
+  MUST be left untouched - do not click them, do not type into them.
+- Leaving a personal field EMPTY is correct and expected. A personal field is
+  NOT an unanswered question: never treat it as one, and never delay "done"
+  because of it.
+- If every remaining question is personal, return done.
+- Demographics and free-text personal questions (gender, marital status, "tell
+  us about yourself") are the human's to answer: prefer to skip them too.
+`;
+const fieldSafety = {
+    stopOnUserInput: false,
+    allowPersonal: false,
+};
+/** fieldKey -> why the field must not be typed into for the rest of the run. */
+const skippedFields = new Map();
+/**
+ * Stealth mode has no DOM, so fields are identified by the focused OS control
+ * (AutomationId|ClassName|Name) instead of a field key.
+ */
+const skippedOsFields = new Map();
+function signalsOf(el) {
+    return {
+        tag: el.tag,
+        type: el.type,
+        name: el.name,
+        id: el.id,
+        autocomplete: el.autocomplete,
+        placeholder: el.placeholder,
+        ariaLabel: el.ariaLabel,
+        label: el.label,
+        questionText: el.questionText,
+        text: el.text,
+    };
+}
+function classificationOf(el) {
+    return {
+        tier: el.personalTier ?? null,
+        category: el.personalCategory ?? null,
+        label: el.personalLabel ?? '',
+        reason: el.personalReason ?? '',
+    };
+}
+/**
+ * Classify every typable element and stamp its stable field key. Elements are
+ * annotated in place so the gate below never re-parses the DOM.
+ */
+function annotateFieldSafety(elements) {
+    for (const el of elements) {
+        const signals = signalsOf(el);
+        el.fieldKey = (0, personal_fields_1.fieldKeyOf)(signals);
+        if (!el.typable)
+            continue;
+        const cls = (0, personal_fields_1.classifyField)(signals);
+        el.personalTier = cls.tier;
+        el.personalCategory = cls.category;
+        el.personalLabel = cls.label;
+        el.personalReason = cls.reason;
+    }
+}
+function shortLabel(el) {
+    const raw = el.label || el.questionText || el.text || el.placeholder || el.name || '';
+    return raw.replace(/\s+/g, ' ').trim().slice(0, 60);
+}
+/**
+ * Returns a human-readable reason when this element must not be typed into,
+ * or null when it is fine to type.
+ */
+function fieldGate(el) {
+    if (!el || !el.typable)
+        return null;
+    const key = el.fieldKey ?? (0, personal_fields_1.fieldKeyOf)(signalsOf(el));
+    const already = skippedFields.get(key);
+    if (already)
+        return already.note;
+    const cls = classificationOf(el);
+    if (cls.tier === null)
+        return null;
+    if (!(0, personal_fields_1.isBlocked)(cls, { allowPersonal: fieldSafety.allowPersonal }))
+        return null;
+    const note = `left to you (${cls.category}: "${shortLabel(el) || cls.label}")`;
+    skippedFields.set(key, { kind: 'personal', note });
+    console.log(`[browse] Not answering a personal question - ${note}`);
+    return note;
+}
+/** Record a field the human took over mid-typing; it is never typed again. */
+function noteHumanTookOver(el, reason) {
+    const key = el?.fieldKey ?? (el ? (0, personal_fields_1.fieldKeyOf)(signalsOf(el)) : '');
+    if (!key)
+        return;
+    const note = `you answered this one yourself (${reason})`;
+    skippedFields.set(key, { kind: 'human', note });
+    console.log(`[browse] Stopped typing - ${note}`);
+}
+function personalSkipSummary() {
+    let personal = 0;
+    let human = 0;
+    for (const entry of skippedFields.values()) {
+        if (entry.kind === 'personal')
+            personal++;
+        else
+            human++;
+    }
+    return { personal, human };
+}
 /**
  * Extract all interactive elements from the DOM with their exact text,
  * bounding boxes, state, and question group assignments.
@@ -1224,6 +1401,29 @@ async function extractElements(page) {
           text,
           tag: el.tagName.toLowerCase(),
           type: el.type || el.getAttribute('role') || '',
+          typable: el.tagName === 'INPUT' || el.tagName === 'TEXTAREA' || el.isContentEditable === true,
+          name: el.getAttribute('name') || '',
+          id: el.getAttribute('id') || '',
+          autocomplete: el.getAttribute('autocomplete') || '',
+          placeholder: el.getAttribute('placeholder') || '',
+          ariaLabel: el.getAttribute('aria-label') || '',
+          label: (() => {
+            try {
+              const id = el.getAttribute('id');
+              if (id) {
+                const forLabel = document.querySelector('label[for="' + CSS.escape(id) + '"]');
+                if (forLabel && forLabel.innerText) return forLabel.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              }
+              const wrap = el.closest ? el.closest('label') : null;
+              if (wrap && wrap.innerText) return wrap.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              const labelled = el.getAttribute('aria-labelledby');
+              if (labelled) {
+                const t = document.getElementById(labelled);
+                if (t && t.innerText) return t.innerText.trim().replace(/\\s+/g, ' ').slice(0, 200);
+              }
+            } catch (err) {}
+            return '';
+          })(),
           checked: el.checked || el.getAttribute('aria-checked') === 'true' || false,
           x: Math.round(rect.x + rect.width / 2),
           y: Math.round(rect.y + rect.height / 2),
@@ -1336,6 +1536,13 @@ async function extractElements(page) {
           y: item.y,
           group: item.groupId,
           inViewport: item.inViewport,
+          typable: item.typable,
+          name: item.name,
+          id: item.id,
+          autocomplete: item.autocomplete,
+          placeholder: item.placeholder,
+          ariaLabel: item.ariaLabel,
+          label: item.label,
         });
       });
 
@@ -1344,7 +1551,9 @@ async function extractElements(page) {
   `;
     try {
         const result = await cdpEval(page, js);
-        return result?.result?.value || [];
+        const elements = result?.result?.value || [];
+        annotateFieldSafety(elements);
+        return elements;
     }
     catch {
         return [];
@@ -1393,6 +1602,11 @@ async function executeAction(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 // 1. Detect editor type
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
@@ -1407,12 +1621,19 @@ async function executeAction(page, act, elements, charDelayMs) {
                 // 3. Normalize indentation for code editors (LLM often adds extra indent)
                 const text = isCodeEditor ? normalizeCodeIndent(rawText) : rawText;
                 console.log(`[browse] Typing ${text.length} characters...`);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
                 if (isCodeEditor) {
-                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs);
+                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs, guard);
                 }
                 else {
-                    await insertIntoGenericInput(page, el, text, charDelayMs);
+                    await insertIntoGenericInput(page, el, text, charDelayMs, guard);
                 }
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'write_code': {
@@ -1423,6 +1644,11 @@ async function executeAction(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 // 1. Detect editor type
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
@@ -1435,13 +1661,20 @@ async function executeAction(page, act, elements, charDelayMs) {
                     .replace(/\\"/g, '"')
                     .replace(/\\\\/g, '\\');
                 console.log(`[browse] Writing code (${text.length} chars)...`);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
                 // 3. write_code inserts EXACTLY as-is — no normalizeCodeIndent
                 if (isCodeEditor) {
-                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs);
+                    await insertIntoCodeEditor(page, editor.selector, text, charDelayMs, guard);
                 }
                 else {
-                    await insertIntoGenericInput(page, el, text, charDelayMs);
+                    await insertIntoGenericInput(page, el, text, charDelayMs, guard);
                 }
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'scroll': {
@@ -1515,6 +1748,11 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
                 if (editor)
@@ -1533,7 +1771,16 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     pressKeyOS('ctrl+a');
                     await sleep(randomInt(50, 100));
                 }
-                await typeHumanLike(text, charDelayMs);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
+                if (guard)
+                    await guard.arm({ isCodeEditor });
+                await typeHumanLike(text, charDelayMs, guard);
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'write_code': {
@@ -1544,6 +1791,11 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     console.log(`[browse] Element index ${act.elementIndex} not found, will retry`);
                     return false;
                 }
+                const gated = fieldGate(el);
+                if (gated) {
+                    console.log(`[browse] Skipping element ${el.i} - ${gated}`);
+                    return true;
+                }
                 const editor = await detectEditor(page);
                 const isCodeEditor = editor !== null;
                 if (editor)
@@ -1561,7 +1813,16 @@ async function executeActionHybrid(page, act, elements, charDelayMs) {
                     pressKeyOS('ctrl+a');
                     await sleep(randomInt(50, 100));
                 }
-                await typeHumanLike(text, charDelayMs);
+                const guard = new human_input_guard_1.TypingGuard({
+                    enabled: fieldSafety.stopOnUserInput,
+                    page,
+                    label: shortLabel(el),
+                });
+                if (guard)
+                    await guard.arm({ isCodeEditor });
+                await typeHumanLike(text, charDelayMs, guard);
+                if (guard.stopped)
+                    noteHumanTookOver(el, guard.describeStop());
                 return true;
             }
             case 'scroll': {
@@ -1748,13 +2009,21 @@ function hasUnansweredQuestions(elements) {
         const types = els.map((e) => e.type);
         const isRadio = types.some((t) => t === 'radio');
         const isCheckbox = types.some((t) => t === 'checkbox');
-        const hasInput = els.some((e) => e.tag === 'input' || e.tag === 'textarea');
+        // Personal fields are the human's to answer: they are never "unanswered"
+        // for the agent, so a `done` from the model with them left empty sticks
+        // instead of triggering the "you must answer everything" retry loop.
+        const inputs = els.filter((e) => (e.tag === 'input' || e.tag === 'textarea') &&
+            e.type !== 'radio' &&
+            e.type !== 'checkbox' &&
+            e.typable !== false);
+        const openInputs = inputs.filter((e) => !(0, personal_fields_1.excludesFromCompleteness)(classificationOf(e)));
+        const hasInput = openInputs.length > 0;
         const checkedCount = els.filter((e) => e.checked).length;
         if (isRadio && checkedCount === 0)
             return true;
         if (isCheckbox && checkedCount < els.length)
             return true;
-        if (hasInput && !els.some((e) => e.text && e.tag === 'input'))
+        if (hasInput && !openInputs.some((e) => e.text && e.tag === 'input'))
             return true;
     }
     return false;
@@ -1979,7 +2248,7 @@ async function removeTrailingBrackets(page) {
     console.log(`[browse] Removed ${extra} extra trailing bracket(s)`);
 }
 /** Insert text into ANY code editor — character-by-character typing, no pasting. */
-async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
+async function insertIntoCodeEditor(page, selector, text, charDelayMs, guard) {
     // Focus the editor
     await focusSelector(page, selector);
     await sleep(100);
@@ -2031,8 +2300,12 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
     // Type character by character — NO pasting
     const est = Math.round(text.length * charDelayMs / 1000);
     console.log(`[browse] Typing ${text.length} chars (~${est}s est.)...`);
+    if (guard)
+        await guard.arm({ selector, isCodeEditor: true });
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
+        if (guard)
+            await guard.markOwn(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         if (char === '\n') {
             await cdpSend(page, 'Input.dispatchKeyEvent', {
                 type: 'keyDown', key: 'Enter', code: 'Enter', text: '\r',
@@ -2070,7 +2343,16 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
             await cdpSend(page, 'Input.dispatchKeyEvent', upParams);
         }
         await sleep(variableDelay(charDelayMs, char, i, text.length));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
     // Post-typing: detect and remove extra trailing brackets
     await removeTrailingBrackets(page);
     // Re-enable auto-formatting
@@ -2091,7 +2373,7 @@ async function insertIntoCodeEditor(page, selector, text, charDelayMs) {
     console.log(`[browse] Typing complete (${text.length} chars)`);
 }
 /** Insert text into a generic input — click focus + char-by-char typing. */
-async function insertIntoGenericInput(page, el, text, charDelayMs) {
+async function insertIntoGenericInput(page, el, text, charDelayMs, guard) {
     await cdpSend(page, 'Input.dispatchMouseEvent', {
         type: 'mousePressed', x: el.x, y: el.y, button: 'left', clickCount: 1,
     });
@@ -2101,8 +2383,12 @@ async function insertIntoGenericInput(page, el, text, charDelayMs) {
     await sleep(200);
     await clearEditor(page);
     await sleep(200);
+    if (guard)
+        await guard.arm({ isCodeEditor: false });
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
+        if (guard)
+            await guard.markOwn(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         if (char === '\n') {
             await cdpSend(page, 'Input.dispatchKeyEvent', {
                 type: 'keyDown', key: 'Enter', code: 'Enter', text: '\r',
@@ -2140,7 +2426,16 @@ async function insertIntoGenericInput(page, el, text, charDelayMs) {
             await cdpSend(page, 'Input.dispatchKeyEvent', upParams);
         }
         await sleep(variableDelay(charDelayMs, char, i, text.length));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
 }
 /**
  * Extract page context for the LLM: title, URL, headings, errors, editor content.
@@ -2445,7 +2740,10 @@ function extractScatteredActions(str) {
     }
     return actions;
 }
-async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, elements, pageContext, timeoutMs, attempt, maxAttempts, page, lastFingerprint) {
+async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, elements, pageContext, timeoutMs, attempt, maxAttempts, page, lastFingerprint, budget = {
+    maxTokens: DEEP_MAX_TOKENS,
+    deep: false,
+}) {
     const startTime = Date.now();
     // Format element list grouped by question
     const groups = new Map();
@@ -2492,7 +2790,11 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
         for (const el of els) {
             const checked = el.checked ? ' [CHECKED]' : '';
             const visibility = el.inViewport ? '' : ' [OFF-SCREEN]';
-            lines.push(`  ${el.i}: [${el.type || el.tag}] "${el.text}"${checked}${visibility}`);
+            const skipNote = el.fieldKey && skippedFields.has(el.fieldKey)
+                ? ` [SKIPPED: ${skippedFields.get(el.fieldKey).note}]`
+                : '';
+            const personal = el.typable ? (0, personal_fields_1.promptMarker)(classificationOf(el)) : '';
+            lines.push(`  ${el.i}: [${el.type || el.tag}] "${el.text}"${checked}${visibility}${personal}${skipNote}`);
         }
         lines.push('');
     }
@@ -2504,7 +2806,12 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
     const body = {
         model,
         messages: [
-            { role: 'system', content: SYSTEM_PROMPT },
+            {
+                role: 'system',
+                content: (budget.deep
+                    ? SYSTEM_PROMPT.replace(FAST_RULE_0, DEEP_RULE_0)
+                    : SYSTEM_PROMPT) + PERSONAL_SAFETY_RULES,
+            },
             {
                 role: 'user',
                 content: [
@@ -2514,7 +2821,7 @@ async function analyzeScreenshot(baseUrl, apiKey, model, screenshotBase64, eleme
             },
         ],
         temperature: 0.1,
-        max_tokens: 2048,
+        max_tokens: budget.maxTokens,
         stream: false,
     };
     const controller = new AbortController();
@@ -2667,7 +2974,7 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
     const body = {
         model,
         messages: [
-            { role: 'system', content: customSystemPrompt },
+            { role: 'system', content: customSystemPrompt + PERSONAL_SAFETY_RULES },
             {
                 role: 'user',
                 content: [
@@ -2677,7 +2984,7 @@ async function analyzeScreenshotWithPrompt(baseUrl, apiKey, model, screenshotBas
             },
         ],
         temperature: 0.1,
-        max_tokens: 2048,
+        max_tokens: DEEP_MAX_TOKENS,
         stream: false,
     };
     const controller = new AbortController();
@@ -2945,19 +3252,24 @@ function getAdjacentKey(char) {
  * Type text with human-like patterns: variable speed, occasional typos,
  * backspaces, natural pauses. Uses OS-level keyboard (no CDP).
  */
-async function typeHumanLike(text, baseDelayMs = 120) {
+async function typeHumanLike(text, baseDelayMs = 120, guard) {
+    const send = async (ch, keyName) => {
+        if (guard)
+            await guard.markOwn(ch, keyName);
+        typeCharOS(ch);
+    };
     for (let i = 0; i < text.length; i++) {
         const char = text[i];
         // 1. Occasional typo (2% chance) — then backspace to correct
         if (char !== '\n' && char !== '\t' && Math.random() < 0.02) {
             const wrong = getAdjacentKey(char);
-            typeCharOS(wrong);
+            await send(wrong);
             await sleep(randomInt(40, 120));
-            typeCharOS('\b'); // backspace
+            await send('\b', 'Backspace'); // backspace
             await sleep(randomInt(25, 70));
         }
         // 2. Type the correct character
-        typeCharOS(char);
+        await send(char, char === '\n' ? 'Enter' : char === '\t' ? 'Tab' : undefined);
         // 3. Variable delay based on character type (human rhythm)
         let delay = baseDelayMs + randomInt(-Math.floor(baseDelayMs * 0.3), Math.floor(baseDelayMs * 0.4));
         if (char === ' ')
@@ -2979,7 +3291,16 @@ async function typeHumanLike(text, baseDelayMs = 120) {
             await sleep(randomInt(200, 600));
         }
         await sleep(Math.max(delay, 30));
+        if (guard) {
+            await guard.tick(text.slice(0, i + 1));
+            if (guard.stopped) {
+                console.log(`[browse] Typing stopped after ${i + 1}/${text.length} chars`);
+                break;
+            }
+        }
     }
+    if (guard)
+        await guard.dispose();
 }
 /**
  * Wait for the screen to change by comparing screenshots.
@@ -3042,7 +3363,7 @@ async function callStealthLLM(baseUrl, apiKey, model, screenshotPath, timeoutMs,
             body: JSON.stringify({
                 model,
                 messages: [
-                    { role: 'system', content: systemPrompt },
+                    { role: 'system', content: systemPrompt + PERSONAL_SAFETY_RULES },
                     {
                         role: 'user',
                         content: [
@@ -3139,9 +3460,41 @@ async function runStealthLoop(baseUrl, apiKey, model, maxActions, intervalMs, ti
                 }
                 case 'type': {
                     if (result.text && result.text.length > 0) {
+                        const guard = new human_input_guard_1.TypingGuard({
+                            enabled: fieldSafety.stopOnUserInput,
+                            osLevel: true,
+                            label: result.text.slice(0, 40),
+                        });
+                        // Stealth has no DOM: use the focused control's own name as the
+                        // label for both the personal classifier and the human-skip list.
+                        const control = await guard.currentOsControl().catch(() => null);
+                        if (control) {
+                            if (control.signature && skippedOsFields.has(control.signature)) {
+                                console.log(`[stealth] Skipping field - ${skippedOsFields.get(control.signature)}`);
+                                actionCount++;
+                                break;
+                            }
+                            if (control.name && fieldSafety.allowPersonal === false) {
+                                const cls = (0, personal_fields_1.classifyField)({ label: control.name, ariaLabel: control.name });
+                                if ((0, personal_fields_1.isBlocked)(cls, { allowPersonal: fieldSafety.allowPersonal })) {
+                                    skippedOsFields.set(control.signature, `left to you (${cls.category}: "${control.name.slice(0, 60)}")`);
+                                    console.log(`[stealth] Not answering a personal question - left to you (${cls.category}: "${control.name.slice(0, 60)}")`);
+                                    actionCount++;
+                                    break;
+                                }
+                            }
+                        }
                         console.log(`[stealth] Typing ${result.text.length} chars...`);
                         await sleep(randomInt(300, 700)); // natural pause before typing
-                        await typeHumanLike(result.text, charDelayMs);
+                        await guard.arm({ isCodeEditor: false });
+                        await typeHumanLike(result.text, charDelayMs, guard);
+                        if (guard.stopped) {
+                            const after = await guard.currentOsControl().catch(() => null);
+                            const sig = after?.signature || control?.signature;
+                            if (sig)
+                                skippedOsFields.set(sig, `you answered this one yourself (${guard.describeStop()})`);
+                            console.log(`[stealth] Stopped typing - you answered this one yourself (${guard.describeStop()})`);
+                        }
                         actionCount++;
                     }
                     else {