fix(verifier): a secure field's typed value never reaches the record

A folio login run wrote the account email and password in cleartext into
llm-calls.jsonl, 166 times in one run, beside screenshots of the same
screens. Three sites rendered it: the recent-action memory, the candidate
list, and the trace. One helper now covers all three so a fourth cannot
bypass it, and the driver still receives the real text.

Android redacts every typed value because it cannot tell a secure field
from any other. That asymmetry is deliberate and documented: safe by
default on the target that cannot tell.

internal/verifier/extractor_encoding_test.go

@@ -43,6 +43,7 @@ const canonicalElement = `{
 	"enabled": true,
 	"focused": false,
 	"id": "TxnAmountField",
+	"secure": null,
 	"selected": false,
 	"text": "199",
 	"x": 200,

internal/verifier/llm.go

@@ -82,6 +82,12 @@ func (v *Verifier) CurrentScreen() string {
 	return v.lastTree.Elements[0].Screen
 }
 
+// Tree returns the hierarchy of the most recent snapshot, nil when none was
+// pushed. It is what a caller resolves an action's target against.
+func (v *Verifier) Tree() *hierarchy.Tree {
+	return v.lastTree
+}
+
 // SampleInput draws one InputText value from the shared corpus via the bundled
 // __sanderlingSampleInput__. It errors when the bundle did not install the
 // callable (a raw-JS fixture) so the caller can skip typing rather than send an
@@ -139,6 +145,10 @@ type ActionCandidate struct {
 	// prob is the internal accumulated selection probability, summed across
 	// dedup, then rounded into Weight. Not exposed in the prompt directly.
 	prob float64
+	// secure is what the target reports about being a secure text entry, which
+	// is what Description is rendered under. It is not part of what the model
+	// sees.
+	secure secureFact
 }
 
 // maxLabelRunes caps a visible-text label so joined descendant text stays short
@@ -402,6 +412,7 @@ func (v *Verifier) candidateFromDescriptor(value goja.Value, labels labelContext
 			Kind:      kind,
 			Label:     target.label,
 			InputType: target.inputType,
+			secure:    target.secure,
 			Action:    Action{Kind: kind, On: target.selector, X: target.x, Y: target.y, Text: text},
 		}, true
 	case ActionKindScroll:
@@ -464,6 +475,7 @@ type resolvedTarget struct {
 	selector  string
 	label     string
 	inputType string
+	secure    secureFact
 }
 
 // resolveTarget reads an authored action's target. Ax element handles carry
@@ -498,10 +510,13 @@ func (v *Verifier) resolveTarget(value goja.Value, labels labelContext) (resolve
 	if selector == "" {
 		selector = stringField(object, "selector")
 	}
-	target := resolvedTarget{x: x, y: y, selector: selector}
+	target := resolvedTarget{x: x, y: y, selector: selector, secure: secureFactFromHandle(object)}
 	if element := v.findBySelector(selector); element != nil {
 		target.label = labels.label(element)
 		target.inputType = inputTypeHint(element)
+		if !target.secure.reported {
+			target.secure = secureFactOf(element)
+		}
 	}
 	if target.label == "" {
 		target.label = truncateLabel(v.handleLabel(object, labels))
@@ -519,6 +534,7 @@ func (v *Verifier) targetFromSelector(selector string, labels labelContext) reso
 	target.x, target.y = element.Bounds.Center()
 	target.label = labels.label(element)
 	target.inputType = inputTypeHint(element)
+	target.secure = secureFactOf(element)
 	return target
 }
 
@@ -556,6 +572,7 @@ func (v *Verifier) collectBuiltin(verb string, prob float64, weighted bool, labe
 			element := targets[entry.targetIndex].element
 			candidate.Label = labels.label(element)
 			candidate.InputType = inputTypeHint(element)
+			candidate.secure = secureFactOf(element)
 		}
 		*out = append(*out, candidate)
 	}
@@ -664,7 +681,8 @@ func describeCandidate(candidate ActionCandidate) string {
 			}
 			return fmt.Sprintf("Type into %q", candidate.Label)
 		}
-		return fmt.Sprintf("Type %q into %q", candidate.Action.Text, candidate.Label)
+		return fmt.Sprintf("Type %q into %q",
+			recordedInputText(candidate.Action.Text, candidate.secure), candidate.Label)
 	case ActionKindScroll:
 		return "Scroll " + candidate.Direction
 	case ActionKindSwipe:

internal/verifier/llm_test.go

@@ -425,7 +425,9 @@ func TestCandidatesCallsAuthoredLeafOnce(t *testing.T) {
 		t.Errorf("authored action on a disabled control was dropped: %v", descriptions(candidates))
 	}
 	// Authored InputText replays its own sampled value (LLM does not supply it).
-	authored, ok := findCandidate(candidates, `Type "42" into "Amount"`)
+	// The fixture is an android tree, which reports no secure fact, so the
+	// rendered value is redacted while the action still carries it.
+	authored, ok := findCandidate(candidates, `Type "[redacted]" into "Amount"`)
 	if !ok {
 		t.Fatalf("authored typing missing: %v", descriptions(candidates))
 	}
@@ -747,8 +749,8 @@ func TestCandidatesAcceptASingleItemAuthoredSampler(t *testing.T) {
 const webFieldTreeJSON = `{
   "attributes": {"tag": "html", "bounds": "[0,0,400,800]"},
   "children": [
-    {"attributes": {"resource-id": "txn-amount", "tag": "input", "class": "input amount-input", "bounds": "[0,100,400,160]"}, "editable": true, "enabled": true, "children": []},
-    {"attributes": {"resource-id": "txn-note", "tag": "input", "class": "input", "bounds": "[0,200,400,260]"}, "editable": true, "enabled": true, "children": []}
+    {"attributes": {"resource-id": "txn-amount", "tag": "input", "class": "input amount-input", "bounds": "[0,100,400,160]"}, "editable": true, "enabled": true, "secure": false, "children": []},
+    {"attributes": {"resource-id": "txn-note", "tag": "input", "class": "input", "bounds": "[0,200,400,260]"}, "editable": true, "enabled": true, "secure": false, "children": []}
   ]
 }`
 
@@ -761,14 +763,14 @@ const webFieldTreeJSON = `{
 func TestCandidatesNameWebAuthoredFieldsByTheirHint(t *testing.T) {
 	const amountHandle = `{
       "id": "txn-amount", "text": "", "desc": "", "class": "input amount-input",
-      "clickable": true, "enabled": true, "editable": true, "focused": false,
+      "clickable": true, "enabled": true, "editable": true, "focused": false, "secure": false,
       "x": 200, "y": 130, "bounds": {"left": 0, "top": 100, "right": 400, "bottom": 160},
       "attrs": {"tag": "input", "aria-label": "", "id": "txn-amount",
                 "class": "input amount-input", "placeholder": "0.00", "hintText": "Amount"}
     }`
 	const noteHandle = `{
       "id": "txn-note", "text": "", "desc": "", "class": "input",
-      "clickable": true, "enabled": true, "editable": true, "focused": false,
+      "clickable": true, "enabled": true, "editable": true, "focused": false, "secure": false,
       "x": 200, "y": 230, "bounds": {"left": 0, "top": 200, "right": 400, "bottom": 260},
       "attrs": {"tag": "input", "aria-label": "", "id": "txn-note", "class": "input",
                 "placeholder": "What's this for?", "hintText": "Note (optional)"}
@@ -807,7 +809,7 @@ func TestCandidatesNameWebAuthoredFieldsByTheirHint(t *testing.T) {
 // The identifier arm must stay blind to anything a user reads, hint included.
 func TestCandidatesNameWebAuthoredFieldsByIdentifierOnThatArm(t *testing.T) {
 	const amountHandle = `{
-      "id": "txn-amount", "text": "", "editable": true, "enabled": true,
+      "id": "txn-amount", "text": "", "editable": true, "enabled": true, "secure": false,
       "x": 200, "y": 130,
       "attrs": {"tag": "input", "hintText": "Amount"}
     }`

internal/verifier/marshal.go

@@ -124,6 +124,14 @@ func nodeObject(runtime *goja.Runtime, tree *hierarchy.Tree, node *hierarchy.Nod
 	_ = object.Set("focused", element.Focused)
 	_ = object.Set("selected", element.Selected)
 	_ = object.Set("editable", element.Editable)
+	// Three-valued, unlike the other state flags: null where the platform
+	// reported nothing at all, which is what separates an ordinary field from a
+	// password field on a platform that cannot tell them apart.
+	var secure any
+	if element.SecureReported() {
+		secure = element.Secure
+	}
+	_ = object.Set("secure", secure)
 	_ = object.Set("x", centerX)
 	_ = object.Set("y", centerY)
 	_ = object.Set(tagSelector, unambiguousSelector(tree, node, selector))

internal/verifier/redaction.go

@@ -0,0 +1,71 @@
+package verifier
+
+import (
+	"github.com/dop251/goja"
+
+	"github.com/priyanshujain/sanderling/internal/hierarchy"
+)
+
+// RedactedInputText stands in for a typed value in every record. It is fixed,
+// so it gives away neither the value nor its length.
+const RedactedInputText = "[redacted]"
+
+// secureFact is what a target says about being a secure text entry. `reported`
+// separates "the platform says this is not one" from "the platform says
+// nothing", which are the two cases the redaction rule has to tell apart.
+type secureFact struct {
+	reported bool
+	secure   bool
+}
+
+// secureFactFromHandle reads an element handle's own report. The web host
+// injects handles built in the page, which carry no selector to resolve against
+// the goja-side tree, so the handle is the only thing that knows.
+func secureFactFromHandle(object *goja.Object) secureFact {
+	value := object.Get("secure")
+	if value == nil || goja.IsUndefined(value) || goja.IsNull(value) {
+		return secureFact{}
+	}
+	return secureFact{reported: true, secure: value.ToBoolean()}
+}
+
+func secureFactOf(element *hierarchy.Element) secureFact {
+	if element == nil {
+		return secureFact{}
+	}
+	return secureFact{reported: element.SecureReported(), secure: element.Secure}
+}
+
+// RecordedActionText renders the typed value of an action for anything that is
+// persisted or sent, resolving the action's target in the tree it was chosen
+// against.
+func RecordedActionText(action Action, tree *hierarchy.Tree) string {
+	if action.Kind != ActionKindInputText {
+		return action.Text
+	}
+	var target *hierarchy.Element
+	if tree != nil && action.On != "" {
+		target = tree.Find(action.On)
+	}
+	return recordedInputText(action.Text, secureFactOf(target))
+}
+
+// recordedInputText is the one place a typed value is rendered for a record.
+// The prompt's recent-action memory, the numbered candidate list and the trace
+// all go through it, so a fourth record added later cannot publish a value the
+// other three withhold. The driver dispatch reads Action.Text directly and is
+// the only reader of the real value, which is what keeps the app receiving the
+// keystrokes a user would have produced.
+//
+// A target the platform reports as a secure entry is redacted, and so is a
+// target carrying no report at all. iOS and web state the fact on every
+// editable element, so a missing one means Android, whose native tree mapper
+// drops uiautomator's password attribute before the sidecar sees it. There a
+// password field cannot be told from a search box, and the target that cannot
+// be told apart is treated as the credential.
+func recordedInputText(text string, target secureFact) string {
+	if target.reported && !target.secure {
+		return text
+	}
+	return RedactedInputText
+}

internal/verifier/redaction_test.go

@@ -0,0 +1,111 @@
+package verifier
+
+import (
+	"strings"
+	"testing"
+)
+
+// typedCredential stands in for what a login setup types. Nothing rendered for
+// a record may carry it.
+const typedCredential = "fixture-passphrase-9f21"
+
+// secureLoginTreeJSON is the shape iOS and web produce for a login form: both
+// report `secure` on every editable field, so a field carrying `secure:false`
+// is positively known not to be a credential entry.
+const secureLoginTreeJSON = `{
+  "attributes": {"bounds": "[0,0,390,844]", "class": "Window"},
+  "children": [
+    {"attributes": {"identifier": "LoginEmail", "class": "TextField", "hintText": "Email", "bounds": "[20,200,370,244]"},
+     "editable": true, "enabled": true, "secure": false, "children": []},
+    {"attributes": {"identifier": "LoginPassword", "class": "SecureTextField", "hintText": "Password", "bounds": "[20,260,370,304]"},
+     "editable": true, "enabled": true, "secure": true, "children": []}
+  ]
+}`
+
+// androidLoginTreeJSON is the same form as Android reports it. The native tree
+// mapper drops uiautomator's password attribute, so neither field carries the
+// fact and the two are indistinguishable.
+const androidLoginTreeJSON = `{
+  "attributes": {"bounds": "[0,0,1080,2340]"},
+  "children": [
+    {"attributes": {"resource-id": "login_email", "class": "android.widget.EditText", "hintText": "Email", "bounds": "[20,200,1060,300]"},
+     "enabled": true, "children": []},
+    {"attributes": {"resource-id": "login_password", "class": "android.widget.EditText", "hintText": "Password", "bounds": "[20,320,1060,420]"},
+     "enabled": true, "children": []}
+  ]
+}`
+
+func authoredTypingCandidates(t *testing.T, selector, text, treeJSON string) []ActionCandidate {
+	t.Helper()
+	actions := `{kind:'actions', generate: () => [{kind:'InputText', into:'` + selector +
+		`', text:'` + text + `'}]}`
+	return mustCandidates(t, enumVerifier(t, actions, treeJSON), LabelSourceVisibleText)
+}
+
+func TestCandidatesRedactTextTypedIntoASecureField(t *testing.T) {
+	candidates := authoredTypingCandidates(t, "id:LoginPassword", typedCredential, secureLoginTreeJSON)
+	if len(candidates) != 1 {
+		t.Fatalf("candidates = %v, want the one authored typing action", descriptions(candidates))
+	}
+	candidate := candidates[0]
+	if !strings.Contains(candidate.Description, RedactedInputText) {
+		t.Errorf("candidate description = %q, want the typed value redacted", candidate.Description)
+	}
+	if !strings.Contains(candidate.Description, "Password") {
+		t.Errorf("candidate description = %q, want it to still name the field typed into", candidate.Description)
+	}
+	if candidate.Action.Text != typedCredential {
+		t.Errorf("candidate action text = %q, want the real value so the driver still types it", candidate.Action.Text)
+	}
+}
+
+func TestCandidatesRedactEveryTypedValueWhereTheTargetCannotReportSecure(t *testing.T) {
+	for _, selector := range []string{"id:login_email", "id:login_password"} {
+		candidates := authoredTypingCandidates(t, selector, typedCredential, androidLoginTreeJSON)
+		if len(candidates) != 1 {
+			t.Fatalf("%s: candidates = %v, want the one authored typing action", selector, descriptions(candidates))
+		}
+		if strings.Contains(candidates[0].Description, typedCredential) {
+			t.Errorf("%s: candidate description carries the typed value: %q", selector, candidates[0].Description)
+		}
+	}
+}
+
+func TestCandidatesKeepTextTypedIntoAFieldReportedNotSecure(t *testing.T) {
+	const address = "[email protected]"
+	candidates := authoredTypingCandidates(t, "id:LoginEmail", address, secureLoginTreeJSON)
+	if len(candidates) != 1 {
+		t.Fatalf("candidates = %v, want the one authored typing action", descriptions(candidates))
+	}
+	if !strings.Contains(candidates[0].Description, address) {
+		t.Errorf("candidate description = %q, want the typed value on a field reported not secure", candidates[0].Description)
+	}
+}
+
+// A spec that types into an element HANDLE is the shape every login setup has
+// (examples/folio/sanderling/spec.ts). The handle carries the goja host's own
+// `secure` field, which is a plain boolean and reads false on a platform that
+// reports nothing, so a rule trusting it would leave every Android value in the
+// clear. The tree the handle names is the only carrier of the three-way fact.
+func TestCandidatesRedactTextTypedIntoAnAndroidElementHandle(t *testing.T) {
+	v := newVerifier(t)
+	loadActionSpec(t, v, `
+		import { InputText, actions, extract } from "@sanderling/spec";
+		const field = extract((s) => s.ax.find({ "resource-id": "login_password" })).named("field");
+		globalThis.actions = actions(() =>
+			field.current ? [InputText({ into: field.current, text: "`+typedCredential+`" })] : []);
+	`)
+	pushTree(t, v, androidLoginTreeJSON)
+
+	candidates := mustCandidates(t, v, LabelSourceVisibleText)
+	if len(candidates) != 1 {
+		t.Fatalf("candidates = %v, want the one authored typing action", descriptions(candidates))
+	}
+	if strings.Contains(candidates[0].Description, typedCredential) {
+		t.Errorf("candidate description carries the typed value: %q", candidates[0].Description)
+	}
+	if candidates[0].Action.Text != typedCredential {
+		t.Errorf("candidate action text = %q, want the real value so the driver still types it",
+			candidates[0].Action.Text)
+	}
+}