Audit 2026-10-04: password-field refusal, multi-monitor cursor, extension policy/injection fixes

[sheehanmunim]

Fixes from the 2026-10-04 audit. Each one is small and has its own commit. Nothing is released or published.

Rust server (windows-linux)

1. Password fields were never refused on Windows or Linux (e61762d). The type_text tool text and the README both say typing into password fields is refused by default (COMPUTER_USE_ALLOW_SECURE_FIELD_INPUT=1 turns it on), and the Swift server does refuse. The Rust server never checked. On Windows, set_value also echoed the value back into the transcript. It now matches Swift: when type_text gets an element_id, or set_value targets a password field (UIA IsPassword on Windows, AT-SPI PasswordText on Linux), it focuses the field and hands control back to the user.
   • Verified: cargo test on Windows, 93/93, including a new test for the flag and the message. The Linux build is left to this PR's ubuntu CI job, because no Linux toolchain was available.
2. Real-pointer input could not reach a second monitor on Windows (03d7b1c). The fallback path for clicks, right-clicks, hovers, scrolls and drags used uiautomation's Mouse::move_to/click/right_click/drag_to. Those send MOUSEEVENTF_ABSOLUTE scaled by SM_CXSCREEN/SM_CYSCREEN without MOUSEEVENTF_VIRTUALDESK, which Windows maps onto the primary display only. Coordinates on other monitors were clamped to the primary display's edge. This is the problem already noted and fixed for remote control, except that remote drags still used drag_to. Every real-pointer move now uses SetCursorPos. Drag sends button down, stepped moves, then button up, and the button up is sent even if a move fails.
   • Verified: compiles and tests pass on Windows (cargo test -j 2 --locked), checked against the uiautomation 0.25.1 source and the SendInput docs. Not run against a real multi-monitor desktop.

Chrome extension

3. Script injection through browser_click index (df79624). CLICK_JS put index verbatim into the script it evaluates in the page. The Rust bridge passes any JSON value through, so a string index ran as arbitrary page script through the debugger. That script could, for example, read a password field the snapshot deliberately hides. Only non-negative integers are accepted now.
4. return_state read blocked sites (df79624). The snapshot taken after an action skipped the site rules. A link click, a redirect or a form submit that landed on a blocked site returned that page's content, even though the README says following a link into a blocked site does not get around the rule. The same checkTab that browser_snapshot uses now runs before the read.
5. Stale snapshot indices (83ebab7). Old data-cu-idx tags were never cleared, so an element hidden since the previous snapshot kept its number. querySelector could then send a click or a credential fill to that hidden element.
6. Lost debugger sessions (83ebab7). There was no chrome.debugger.onDetach listener. After the user cancelled Chrome's debugging bar, every later command on that tab failed until the tab was closed.
7. Trailing-dot host bypass (83ebab7). https://bank.example./ slipped past a bank.example block rule. Trailing dots are now dropped from both hosts and patterns.

Verified: node chrome-extension/background.test.mjs passes 41/41. Each of the 5 new tests fails without its fix. scripts/build-extension.test.mjs and check-tool-parity.mjs pass, and tool-defs.mjs --check passes on an LF checkout.

Found but not fixed (for the owner)

• Windows named pipes (bridge and .rpc) use the default DACL, which gives Everyone read access. The pipe name munim-computer-use-bridge-<USERNAME> is predictable. On a multi-user Windows machine, another local user could create that pipe first. The victim's server would then join as a peer, sending its browser commands to that user. The victim's native host would connect to it too, letting that user drive the victim's signed-in Chrome. Fixing this needs an owner-only security descriptor plus a check of the pipe server's identity (GetNamedPipeServerProcessId and its token SID). I could not test this across users here. Unix sockets are fine (0600 inside a 0700 directory).
• The app policy fails open in check_app_policy (main.rs). If list_apps() errors, the rule is matched against the raw query string. A numeric pid then only hits the * rule, so a pid can get around a name-specific block. Failing closed would block every app on sessions where xcap cannot list windows (WSLg), so this is left as a decision for you.
• The process is not DPI-aware on Windows, except for the live-capture thread. Coordinates on scaled displays were not verified.
• Extension, credentials:
  • Values filled through browser_request_credentials can come back to the agent. A page's "show password" toggle turns the field into type=text, and username and code values are always shown as snapshot labels.
  • The model picks the kind of each field.
  • request_credentials is allowed on data: and about: pages, where the origin is null.
• Extension, approvals and listeners: approvedOrigins is never cleared per client, so "ask" approvals outlive the task. The per-tab badge onUpdated listener leaks one listener per closed tab.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.