testronaut 1.3.4 → 1.3.6

package/.devcontainer/devcontainer.json

@@ -3,6 +3,20 @@
 
   "image": "mcr.microsoft.com/devcontainers/javascript-node:22",
 
+  "features": {
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+
+  "secrets": {
+    "GH_TOKEN": {
+      "description": "A GitHub PAT with read access to mission-testronaut/testronaut-demo."
+    }
+  },
+
+  "containerEnv": {
+    "GH_TOKEN": "${localEnv:GH_TOKEN}"
+  },
+
   "customizations": {
     "codespaces": {
       "repositories": {
@@ -11,6 +25,9 @@
         },
         "mission-testronaut/testronaut-examples": {
           "permissions": "write-all"
+        },
+        "mission-testronaut/testronaut-demo": {
+          "permissions": "write-all"
         }
       }
     },
@@ -29,16 +46,17 @@
         "eamodio.gitlens",
         "esbenp.prettier-vscode",
         "dbaeumer.vscode-eslint",
-        "openai.chatgpt"
+        "openai.chatgpt",
+        "anthropic.claude-code"
       ]
     }
   },
 
   "workspaceFolder": "/workspaces",
 
-  "postCreateCommand": "bash -lc 'set -e; cd /workspaces; if [ ! -d \"testronaut-examples/.git\" ]; then git clone https://github.com/mission-testronaut/testronaut-examples.git; fi'",
+  "postCreateCommand": "bash /workspaces/testronaut-cli/.devcontainer/setup-github-auth.sh",
 
-  "postStartCommand": "bash -lc 'git config --global pull.rebase false && git config --global init.defaultBranch main'",
+  "postStartCommand": "bash /workspaces/testronaut-cli/.devcontainer/setup-github-auth.sh",
 
   "hostRequirements": {
     "cpus": 4,

package/.devcontainer/setup-github-auth.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd /workspaces
+
+git config --global pull.rebase false
+git config --global init.defaultBranch main
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "GitHub CLI is not installed. Rebuild the devcontainer so the github-cli feature is installed."
+  exit 1
+fi
+
+if [ -n "${GH_TOKEN:-}" ] && ! gh auth status --hostname github.com >/dev/null 2>&1; then
+  printf '%s\n' "$GH_TOKEN" | gh auth login --hostname github.com --with-token >/dev/null
+fi
+
+if gh auth status --hostname github.com >/dev/null 2>&1; then
+  gh auth setup-git --hostname github.com
+else
+  echo "GitHub CLI is not authenticated."
+  echo "Add GH_TOKEN as a Codespaces secret with access to mission-testronaut/testronaut-demo."
+  exit 1
+fi
+
+clone_if_missing() {
+  local repo="$1"
+  local directory="$2"
+
+  if [ ! -d "$directory/.git" ]; then
+    gh repo clone "$repo" "$directory"
+  fi
+}
+
+clone_if_missing mission-testronaut/testronaut-examples testronaut-examples
+clone_if_missing mission-testronaut/testronaut-demo testronaut-demo

package/.github/workflows/prepare-release.yml

@@ -0,0 +1,168 @@
+name: Prepare Package Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_type:
+        description: Semver increment to prepare
+        required: true
+        type: choice
+        default: patch
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: read
+
+concurrency:
+  group: prepare-package-release
+  cancel-in-progress: false
+
+jobs:
+  authorize-release:
+    name: Authorize Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require main branch
+        run: |
+          if [ "${GITHUB_REF_NAME}" != "main" ]; then
+            echo "Manual release preparation is only allowed from main."
+            exit 1
+          fi
+
+      - name: Require repository admin permission
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const actor = context.actor;
+
+            if (owner.toLowerCase() === actor.toLowerCase()) {
+              core.info(`Actor ${actor} matches the repository owner and is treated as admin.`);
+              return;
+            }
+
+            const response = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner,
+              repo,
+              username: actor,
+            });
+
+            const { permission, role_name: roleName } = response.data;
+            core.info(`Actor ${actor} permission=${permission}, role_name=${roleName}`);
+
+            if (permission !== "admin" && roleName !== "admin") {
+              core.setFailed(`Only repository admins can prepare package releases. ${actor} has ${roleName || permission}.`);
+            }
+
+  prepare-release:
+    name: Prepare Release Pull Request
+    needs: authorize-release
+    runs-on: ubuntu-latest
+    permissions:
+      # Required because this workflow pushes a release branch and opens a PR.
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run automated test suite
+        run: npm test
+
+      - name: Bump package version
+        run: npm version "${{ inputs.release_type }}" --no-git-tag-version
+
+      - name: Read new version
+        id: version
+        run: |
+          VERSION="$(node -e 'process.stdout.write(require("./package.json").version)')"
+          echo "value=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "branch=release/v${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Ensure release branch is not already open
+        env:
+          RELEASE_BRANCH: ${{ steps.version.outputs.branch }}
+        run: |
+          if git ls-remote --exit-code --heads origin "${RELEASE_BRANCH}" >/dev/null 2>&1; then
+            echo "Release branch ${RELEASE_BRANCH} already exists on origin."
+            exit 1
+          fi
+
+      - name: Create release branch
+        env:
+          RELEASE_BRANCH: ${{ steps.version.outputs.branch }}
+        run: git switch -c "${RELEASE_BRANCH}"
+
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Commit release version
+        env:
+          VERSION: ${{ steps.version.outputs.value }}
+        run: |
+          git add package.json package-lock.json
+          git commit -m "chore(release): v${VERSION}"
+
+      - name: Push release branch
+        env:
+          RELEASE_BRANCH: ${{ steps.version.outputs.branch }}
+        run: git push --set-upstream origin "${RELEASE_BRANCH}"
+
+      - name: Open release pull request
+        id: pull-request
+        uses: actions/github-script@v7
+        env:
+          RELEASE_BRANCH: ${{ steps.version.outputs.branch }}
+          VERSION: ${{ steps.version.outputs.value }}
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const head = process.env.RELEASE_BRANCH;
+            const version = process.env.VERSION;
+
+            const pr = await github.rest.pulls.create({
+              owner,
+              repo,
+              title: `chore(release): v${version}`,
+              head,
+              base: "main",
+              body: [
+                `Prepares \`v${version}\` for npm publication.`,
+                "",
+                "After this pull request merges into `main`, the publish workflow will release the package to npm.",
+              ].join("\n"),
+            });
+
+            core.setOutput("url", pr.data.html_url);
+
+      - name: Write job summary
+        env:
+          VERSION: ${{ steps.version.outputs.value }}
+          RELEASE_BRANCH: ${{ steps.version.outputs.branch }}
+          PR_URL: ${{ steps.pull-request.outputs.url }}
+        run: |
+          {
+            echo "## Release PR created"
+            echo
+            echo "- Version: \`${VERSION}\`"
+            echo "- Release branch: \`${RELEASE_BRANCH}\`"
+            echo "- Pull request: ${PR_URL}"
+          } >> "$GITHUB_STEP_SUMMARY"

package/.github/workflows/publish.yml

@@ -0,0 +1,133 @@
+name: Publish Package
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - package.json
+      - package-lock.json
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+
+concurrency:
+  group: publish-package
+  cancel-in-progress: false
+
+jobs:
+  publish-package:
+    name: Publish Package
+    runs-on: ubuntu-latest
+    environment:
+      # Use the same environment name in npm trusted publisher settings if you
+      # want npm to bind publishing to this protected environment.
+      name: package-publish
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect release version
+        id: release
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          EVENT_NAME: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          VERSION="$(node -e 'process.stdout.write(require("./package.json").version)')"
+          PACKAGE_NAME="$(node -e 'process.stdout.write(require("./package.json").name)')"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "package_name=${PACKAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+          if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then
+            if [ "${REF_NAME}" != "main" ]; then
+              echo "Manual publishing is only allowed from main."
+              exit 1
+            fi
+
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -z "${BEFORE_SHA}" ] || [ "${BEFORE_SHA}" = "0000000000000000000000000000000000000000" ]; then
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          PREVIOUS_VERSION="$(git show "${BEFORE_SHA}:package.json" | node -e 'let data=""; process.stdin.on("data", chunk => data += chunk); process.stdin.on("end", () => process.stdout.write(JSON.parse(data).version));')"
+
+          if [ "${PREVIOUS_VERSION}" = "${VERSION}" ]; then
+            echo "Version is unchanged at ${VERSION}; skipping publish."
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Version changed from ${PREVIOUS_VERSION} to ${VERSION}."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Node
+        if: steps.release.outputs.should_publish == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        if: steps.release.outputs.should_publish == 'true'
+        run: npm ci
+
+      - name: Run automated test suite
+        if: steps.release.outputs.should_publish == 'true'
+        run: npm test
+
+      - name: Check whether version already exists on npm
+        if: steps.release.outputs.should_publish == 'true'
+        id: npm-check
+        env:
+          PACKAGE_NAME: ${{ steps.release.outputs.package_name }}
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          if npm view "${PACKAGE_NAME}@${VERSION}" version >/dev/null 2>&1; then
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+            echo "Version ${VERSION} is already published to npm."
+          else
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+            echo "Version ${VERSION} is not yet published to npm."
+          fi
+
+      - name: Publish to npm with trusted publishing
+        if: steps.release.outputs.should_publish == 'true' && steps.npm-check.outputs.should_publish == 'true'
+        run: npm publish --provenance --access public
+
+      - name: Tag published version
+        if: steps.release.outputs.should_publish == 'true' && steps.npm-check.outputs.should_publish == 'true'
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
+            echo "Tag v${VERSION} already exists locally."
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag "v${VERSION}"
+          git push origin "refs/tags/v${VERSION}"
+
+      - name: Write job summary
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          SHOULD_PUBLISH: ${{ steps.release.outputs.should_publish }}
+          NPM_PUBLISH: ${{ steps.npm-check.outputs.should_publish }}
+        run: |
+          {
+            echo "## Publish summary"
+            echo
+            echo "- Version: \`${VERSION}\`"
+            echo "- Trigger requested publish: \`${SHOULD_PUBLISH:-false}\`"
+            echo "- npm publish executed: \`${NPM_PUBLISH:-false}\`"
+          } >> "$GITHUB_STEP_SUMMARY"

package/bin/cli.js

@@ -364,6 +364,70 @@ if (retryFlagIndex >= 0) {
   args.splice(retryFlagIndex, retryOverride ? 2 : 1);
 }
 
+// Look for --human-input / --no-human-input / --disable-human-input
+let humanInputOverride;
+let humanInputConsumesNext = false;
+const humanInputFlagIndex = args.findIndex(a =>
+  a === '--human-input' ||
+  a.startsWith('--human-input=') ||
+  a === '--human_input' ||
+  a.startsWith('--human_input=') ||
+  a === '--no-human-input' ||
+  a === '--disable-human-input'
+);
+if (humanInputFlagIndex >= 0) {
+  const rawArg = args[humanInputFlagIndex];
+  if (rawArg.includes('=')) {
+    humanInputOverride = parseBool(rawArg.split('=')[1]);
+  } else if (rawArg === '--no-human-input' || rawArg === '--disable-human-input') {
+    humanInputOverride = false;
+  } else if (args[humanInputFlagIndex + 1] && !args[humanInputFlagIndex + 1].startsWith('-')) {
+    humanInputOverride = parseBool(args[humanInputFlagIndex + 1]);
+    humanInputConsumesNext = true;
+  } else {
+    humanInputOverride = true;
+  }
+
+  if (humanInputOverride !== null) {
+    process.env.TESTRONAUT_HUMAN_INPUT = humanInputOverride ? '1' : '0';
+    console.log(`👤 Human input tool ${humanInputOverride ? 'enabled' : 'disabled'} (TESTRONAUT_HUMAN_INPUT=${process.env.TESTRONAUT_HUMAN_INPUT})`);
+  } else {
+    console.warn('⚠️ Invalid --human-input value. Use true/false, 1/0, yes/no.');
+  }
+
+  const consume = 1 + (humanInputConsumesNext && humanInputOverride !== null ? 1 : 0);
+  args.splice(humanInputFlagIndex, consume);
+}
+
+// Look for --human-input-timeout / --human_input_timeout in seconds
+let humanInputTimeoutOverride;
+const humanInputTimeoutFlagIndex = args.findIndex(a =>
+  a === '--human-input-timeout' ||
+  a.startsWith('--human-input-timeout=') ||
+  a === '--human_input_timeout' ||
+  a.startsWith('--human_input_timeout=')
+);
+if (humanInputTimeoutFlagIndex >= 0) {
+  const rawArg = args[humanInputTimeoutFlagIndex];
+  if (rawArg.includes('=')) {
+    humanInputTimeoutOverride = rawArg.split('=')[1];
+  } else if (args[humanInputTimeoutFlagIndex + 1]) {
+    humanInputTimeoutOverride = args[humanInputTimeoutFlagIndex + 1];
+  }
+
+  if (humanInputTimeoutOverride) {
+    const n = Number(humanInputTimeoutOverride.trim());
+    if (Number.isFinite(n) && n > 0) {
+      process.env.TESTRONAUT_HUMAN_INPUT_TIMEOUT_SECONDS = String(n);
+      console.log(`⏱️ Human input timeout override: ${process.env.TESTRONAUT_HUMAN_INPUT_TIMEOUT_SECONDS}s`);
+    } else {
+      console.warn(`⚠️ Invalid --human-input-timeout value "${humanInputTimeoutOverride}". Ignoring.`);
+    }
+  }
+
+  args.splice(humanInputTimeoutFlagIndex, humanInputTimeoutOverride ? 2 : 1);
+}
+
 const allResults = [];
 const runId = `run_${Date.now()}`;
 const startTime = new Date();
@@ -386,6 +450,9 @@ Options:
   --provider=<id>           Override LLM provider for this run (e.g., --provider=openai)
   --dev                     Use the staging API base URL
   --vercel-bypass=<secret>  Send Vercel protection bypass header for protected deployments
+  --human-input[=<bool>]    Allow the agent to pause for short verification codes (default: true)
+  --no-human-input          Disable human-in-the-loop verification prompts for automated runs
+  --human-input-timeout=<s> Override human input wait timeout in seconds (default: 60)
   --help                    Show this help message
   --retry_limit=<n>         Override agent turn retry limits (minimum 1, maximum 10)
 

package/bin/init.js

@@ -141,6 +141,7 @@ export async function initializeTestronautProject() {
     config.maxTurns = config.maxTurns ?? defaults.maxTurns;
     config.dom = { ...defaults.dom, ...(config.dom || {}) };
     config.resourceGuard = { ...defaults.resourceGuard, ...(config.resourceGuard || {}) };
+    config.humanInput = { ...defaults.humanInput, ...(config.humanInput || {}) };
 
     // ─────────────────────────────────────────────
     // STEP 4: Persist config and scaffold .env (first run only)

package/bin/initHelpers.js

@@ -60,6 +60,10 @@ export function defaultConfig(rootBasename) {
       hrefIncludes: ['/document/', '/file/', '/download', '/attachment/'],
       dataTypes: ['document', 'file', 'item', 'row'],
     },
+    humanInput: {
+      enabled: true,
+      timeoutSeconds: 60,
+    },
   };
 }
 

package/core/agent.js

@@ -36,7 +36,7 @@ import path from 'path';
  * @param {string} missionName
  * @param {number} [maxTurns=20] - upper bound for turnLoop per goal
  * @param {number} [retryLimit]
- * @param {{ domListLimit?: number|typeof Infinity, debug?: boolean, resourceGuard?: { enabled:boolean, hrefIncludes:string[], dataTypes:string[] } }} [opts]
+ * @param {{ domListLimit?: number|typeof Infinity, debug?: boolean, resourceGuard?: { enabled:boolean, hrefIncludes:string[], dataTypes:string[] }, humanInput?: { enabled:boolean, timeoutSeconds:number } }} [opts]
  * @returns {Promise<Array<{missionName:string, submissionType:string, submissionName:string|null, status:'passed'|'failed', steps:any[], startTime:number, endTime:number}>>}
  */
 export async function runAgent(goals, missionName, maxTurns = 20, retryLimit, opts = {}) {
@@ -135,6 +135,17 @@ Use Ground Control as your persistent mission memory about:
 - Any constraints about staying on the correct site.
       `.trim();
 
+      if (opts.humanInput?.enabled !== false) {
+        systemContent +=
+          '\n\n' +
+          `
+Human-in-the-loop verification:
+- If the app requires a TOTP, SMS, email, or similar short verification code that you cannot retrieve yourself, call request_human_input.
+- Do not ask for passwords, API keys, or long free-form text with this tool.
+- After receiving the code from the tool result, enter it into the appropriate field and continue the mission.
+          `.trim();
+      }
+
       if (groundSummary) {
         systemContent +=
           '\n\n' +
@@ -164,6 +175,7 @@ Use Ground Control as your persistent mission memory about:
           retryLimit, 
           groundControl,
           resourceGuard: opts.resourceGuard,
+          humanInput: opts.humanInput,
           onStep: (s) => {
             // Append each step as a JSON line
             try {

package/core/config.js

@@ -173,6 +173,71 @@ export function getResourceGuardConfig(cfg) {
   return { enabled, hrefIncludes: finalHref, dataTypes: finalTypes };
 }
 
+function parseBool(raw) {
+  if (raw === undefined || raw === null) return null;
+  const lower = String(raw).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on', 'allow', 'enabled'].includes(lower)) return true;
+  if (['0', 'false', 'no', 'off', 'deny', 'disabled'].includes(lower)) return false;
+  return null;
+}
+
+/**
+ * Resolve human-in-the-loop verification input settings.
+ * Priority: CLI/env overrides → testronaut-config.json → built-in defaults.
+ *
+ * Supported config:
+ *   humanInput: { enabled: true, timeoutSeconds: 60 }
+ *   humanInputEnabled / allowHumanInput
+ *   humanInputTimeoutSeconds / humanInputTimeout
+ *
+ * Supported env (set by CLI flags too):
+ *   TESTRONAUT_HUMAN_INPUT=true|false
+ *   TESTRONAUT_HUMAN_INPUT_TIMEOUT_SECONDS=60
+ *
+ * @param {object} cfg
+ * @param {{ enabled?: boolean, timeoutSeconds?: number }} [fallback]
+ * @returns {{ enabled:boolean, timeoutSeconds:number, source:{ enabled:'env'|'config'|'default', timeout:'env'|'config'|'default' }, clamped:boolean }}
+ */
+export function getHumanInputConfig(cfg, fallback = { enabled: true, timeoutSeconds: 60 }) {
+  const clampTimeout = (raw, fb) => {
+    const n = Number(raw);
+    if (!Number.isFinite(n)) return { value: fb, clamped: false };
+    const clamped = Math.min(300, Math.max(5, Math.trunc(n)));
+    return { value: clamped, clamped: clamped !== n };
+  };
+
+  const envEnabled = parseBool(process.env.TESTRONAUT_HUMAN_INPUT);
+  const cfgEnabled = parseBool(cfg?.humanInput?.enabled ?? cfg?.humanInputEnabled ?? cfg?.allowHumanInput);
+  const enabled =
+    envEnabled !== null ? envEnabled :
+    cfgEnabled !== null ? cfgEnabled :
+    fallback.enabled !== false;
+  const enabledSource =
+    envEnabled !== null ? 'env' :
+    cfgEnabled !== null ? 'config' :
+    'default';
+
+  const cfgTimeoutRaw = cfg?.humanInput?.timeoutSeconds ?? cfg?.humanInput?.timeout ?? cfg?.humanInputTimeoutSeconds ?? cfg?.humanInputTimeout;
+  const envTimeoutRaw = process.env.TESTRONAUT_HUMAN_INPUT_TIMEOUT_SECONDS;
+  let timeoutSource = 'default';
+  let timeoutRaw = fallback.timeoutSeconds ?? 60;
+  if (envTimeoutRaw !== undefined) {
+    timeoutRaw = envTimeoutRaw;
+    timeoutSource = 'env';
+  } else if (cfgTimeoutRaw !== undefined) {
+    timeoutRaw = cfgTimeoutRaw;
+    timeoutSource = 'config';
+  }
+
+  const timeout = clampTimeout(timeoutRaw, 60);
+  return {
+    enabled,
+    timeoutSeconds: timeout.value,
+    source: { enabled: enabledSource, timeout: timeoutSource },
+    clamped: timeout.clamped,
+  };
+}
+
 /**
  * Baseline limits for mission runs. Adjust here for global defaults.
  *

package/core/redaction.js

@@ -44,8 +44,13 @@ export const SENSITIVE_KEYWORDS = [
   'auth',
   'pin',
   'otp',
+  'code',
+  'totp',
+  'mfa',
 ];
 
+const VERIFICATION_CODE_KEYWORDS = new Set(['otp', 'code', 'totp', 'mfa']);
+
 /**
  * Builds a single RegExp that treats hyphens as `[-_\s]?` to catch variants.
  * @returns {RegExp}
@@ -141,6 +146,13 @@ function isSensitiveCall(fnName, args = {}) {
 export function redactArgs(fnName, args = {}, { showLength = true } = {}) {
   const out = clone(args);
 
+  if (fnName === 'request_human_input') {
+    for (const key of ['value', 'code', 'input', 'answer', 'redactedValue']) {
+      if (key in out) out[key] = maskPreview(out[key], showLength);
+    }
+    return out;
+  }
+
   // Mask direct props with sensitive-looking keys
   for (const k of Object.keys(out || {})) {
     if (hasSensitiveHint(k)) {
@@ -165,8 +177,8 @@ export function redactArgs(fnName, args = {}, { showLength = true } = {}) {
  * 1) Sensitive-word ... "VALUE"
  *    e.g., `password is "hunter2"`
  *
- * 2) Sensitive-word ... (with|as|to|=) VALUE
- *    e.g., `token=abcd1234`, `auth with xyz`
+ * 2) Sensitive-word ... (with|as|to|=|entered|provided|used|submitted|filled) VALUE
+ *    e.g., `token=abcd1234`, `auth with xyz`, `MFA (entered 123456)`
  *
  * 3) "VALUE" ... into/in/on/to TARGET  (TARGET contains a sensitive hint)
  *    e.g., `Type "Imp0st3r123!" into #access`
@@ -179,18 +191,29 @@ export function redactPasswordInText(text = '', { showLength = true } = {}) {
   let s = String(text ?? '');
 
   // Build a reusable source pattern for SENSITIVE_KEYWORDS with hyphen expansion
-  const kwParts = SENSITIVE_KEYWORDS.map(k => k.replace(/-/g, '[-_\\s]?'));
-  const kwGroup = `(${kwParts.join('|')})`;
+  const strongKwParts = SENSITIVE_KEYWORDS
+    .filter(k => !VERIFICATION_CODE_KEYWORDS.has(k))
+    .map(k => k.replace(/-/g, '[-_\\s]?'));
+  const verificationKwParts = [...VERIFICATION_CODE_KEYWORDS].map(k => k.replace(/-/g, '[-_\\s]?'));
+  const strongKwGroup = `(${strongKwParts.join('|')})`;
+  const verificationKwGroup = `(${verificationKwParts.join('|')})`;
 
   // Case 1: keyword ... "VALUE"
   s = s.replace(
-    new RegExp(`(\\b${kwGroup}\\b[^"'\\\\\\n]{0,80}["'])([^"']+)(["'])`, 'gi'),
+    new RegExp(`(\\b${strongKwGroup}\\b[^"'\\\\\\n]{0,80}(?:[:=]|\\s)["'])([^"'\\n]+)(["'])`, 'gi'),
     (_m, pre, _kw, secret, post) => pre + maskPreview(secret, showLength) + post
   );
 
-  // Case 2: keyword ... (with|as|to|=) VALUE
+  // Case 2: keyword ... (with|as|to|=|entered|provided|used|submitted|filled) VALUE
+  s = s.replace(
+    new RegExp(`(\\b${strongKwGroup}\\b[^.\\n]{0,80}?(?:\\b(with|as|to|entered|provided|used|submitted|filled)\\b|=)\\s*\\(?)([^\\s"'\\\`),.;:]+)`, 'gi'),
+    (_m, pre, _kw1, _kw2, secret) => pre + maskPreview(secret, showLength)
+  );
+
+  // Verification-code words are common UI text. Only redact them when the
+  // phrasing says a concrete value was entered/provided/etc.
   s = s.replace(
-    new RegExp(`(\\b${kwGroup}\\b[^.\\n]{0,80}?\\b(with|as|to|=)\\s*)([^\\s"'\\\`]+)`, 'gi'),
+    new RegExp(`(\\b${verificationKwGroup}\\b[^.\\n]{0,80}?\\b(entered|provided|used|submitted|filled)\\b\\s*\\(?)([A-Za-z0-9_-]{4,64})`, 'gi'),
     (_m, pre, _kw1, _kw2, secret) => pre + maskPreview(secret, showLength)
   );