fix: PCH-01-025 CSS.escape + try/catch label[for] selector in detect.ts — prevents autofill abort on legal CSS-special ids (v3.8.1)

@@ -117,6 +117,34 @@117117 118118     expect(isTOTPField(input)).toBe(true);119119   });120+121+  // PCH-01-025: ids may legally contain CSS-special chars; field detection122+  // must not throw a SyntaxError out of the label[for=...] lookup.123+  it("field_detection_does_not_throw_on_id_with_css_special_chars", () => {124+    const label = document.createElement("label");125+    label.setAttribute("for", "user[email]");126+    label.textContent = "Email";127+    document.body.appendChild(label);128+    const email = visibleInput({ type: "email", name: "email", id: "user[email]" });129+    visibleInput({ type: "password", autocomplete: "current-password" });130+131+    let fields: ReturnType<typeof detectLoginFields> = [];132+    expect(() => {133+      fields = detectLoginFields(document);134+    }).not.toThrow();135+    expect(fields.some((field) => field.el === email)).toBe(true);136+  });137+138+  it("field_detection_does_not_throw_on_id_with_quotes", () => {139+    const email = visibleInput({ type: "email", name: "email", id: "it's-me" });140+    visibleInput({ type: "password", autocomplete: "current-password" });141+142+    let fields: ReturnType<typeof detectLoginFields> = [];143+    expect(() => {144+      fields = detectLoginFields(document);145+    }).not.toThrow();146+    expect(fields.some((field) => field.el === email)).toBe(true);147+  });120148 });121149 122150 describe("card form detection", () => {

@@ -40,8 +40,15 @@4040   if (ariaLabel) return ariaLabel.toLowerCase();4141   const id = field.id;4242   if (id) {43-    const label = document.querySelector<HTMLLabelElement>(`label[for="${id}"]`);44-    if (label) return label.textContent?.toLowerCase() ?? "";43+    // PCH-01-025: ids can contain CSS-special chars (quotes, brackets, leading44+    // digits). Escape, and defensively swallow a malformed-selector throw so a45+    // single weird id can't abort field detection for the whole page.46+    try {47+      const label = document.querySelector<HTMLLabelElement>(`label[for="${CSS.escape(id)}"]`);48+      if (label) return label.textContent?.toLowerCase() ?? "";49+    } catch {50+      /* malformed id — skip label-by-id lookup, continue field detection */51+    }4552   }4653   const wrappingLabel = field.closest("label");4754   if (wrappingLabel?.textContent) return wrappingLabel.textContent.toLowerCase();