fix: enforce browser-issued autofill authority (PB-26-201, v5.0.56)

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "5.0.55",4+  "version": "5.0.56",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -2,7 +2,7 @@22   "manifest_version": 3,33   "minimum_chrome_version": "116",44   "name": "Peach Password Manager",5-  "version": "5.0.55",5+  "version": "5.0.56",66   "description": "Zero-knowledge password manager",77   "action": {88     "default_popup": "src/popup/index.html",

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "5.0.55",3+  "version": "5.0.56",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

@@ -63,7 +63,11 @@6363       // a search-mode palette that copies to clipboard. No popup fallback needed.6464       const origin = new URL(tab.url).origin;6565       const capability = createSummonCapability(tabId, origin, 0);66-      chrome.tabs.sendMessage(tabId, { type: "SUMMON_AUTOFILL", source: "shortcut", capability }).catch(() => {});66+      chrome.tabs.sendMessage(67+        tabId,68+        { type: "SUMMON_AUTOFILL", source: "shortcut", capability },69+        { frameId: 0 },70+      ).catch(() => {});6771       return;6872     }6973 

@@ -958,10 +958,73 @@958958 959959   // --- MV-1: GET_ENTRY_FOR_FILL re-validates the requesting tab's origin ---960960 961-  function tabSender(url: string): chrome.runtime.MessageSender {962-    return { id: "peach-extension", tab: { id: 1, url } as chrome.tabs.Tab, url };961+  function tabSender(url: string, tabId = 1, frameId = 0): chrome.runtime.MessageSender {962+    return { id: "peach-extension", tab: { id: tabId, url } as chrome.tabs.Tab, url, frameId };963963   }964964 965+  async function addPasskeyOnlyEntry(title: string, url: string) {966+    const vault = await import("./vault");967+    const generated = await generatePasskeyKeypair(-7);968+    return vault.addEntry({969+      type: "login",970+      title,971+      url,972+      passkey: {973+        rpId: new URL(url).hostname,974+        rpName: title,975+        credentialId: base64urlEncode(crypto.getRandomValues(new Uint8Array(32))),976+        publicKeyCose: base64urlEncode(generated.publicKeyCose),977+        privateKeyJwk: generated.privateKeyJwk,978+        userHandle: base64urlEncode(crypto.getRandomValues(new Uint8Array(32))),979+        userName: "june",980+        userDisplayName: "June",981+        algorithm: -7,982+        signCount: 0,983+        aaguid: "AAAAAAAAAAAAAAAAAAAAAA",984+        backupEligible: true,985+        backupState: false,986+        createdAt: Date.now(),987+      },988+    });989+  }990+991+  it("PB-26-201: normal inventory ignores forged domain and gesture booleans", async () => {992+    const vault = await import("./vault");993+    await vault.createVault("correct-pass-12345");994+    await vault.addEntry({ title: "GitHub", username: "victim", password: "secret", url: "https://github.com" });995+    await vault.addEntry({ title: "Evil", username: "attacker", password: "known", url: "https://evil.example.com" });996+997+    const result = await dispatch(998+      {999+        type: "AUTOFILL_QUERY",1000+        payload: {1001+          domain: "github.com",1002+          includeAll: true,1003+          userGesture: true,1004+          explicitSummon: true,1005+        },1006+      },1007+      tabSender("https://evil.example.com/phish"),1008+    );1009+1010+    expect(result).toMatchObject({ ok: true });1011+    expect((result.data as Array<{ title: string }>).map((entry) => entry.title)).toEqual(["Evil"]);1012+  });1013+1014+  it("PB-26-201: normal TOTP inventory is scoped to the attested frame origin", async () => {1015+    const vault = await import("./vault");1016+    await vault.createVault("correct-pass-12345");1017+    await vault.addEntry({ title: "GitHub 2FA", password: "secret", url: "https://github.com", totp: "JBSWY3DPEHPK3PXP" });1018+    await vault.addEntry({ title: "Evil 2FA", password: "known", url: "https://evil.example.com", totp: "JBSWY3DPEHPK3PXP" });1019+1020+    const result = await dispatch(1021+      { type: "AUTOFILL_QUERY", payload: { domain: "github.com", kind: "totp" } },1022+      tabSender("https://evil.example.com/verify"),1023+    );1024+1025+    expect((result.data as Array<{ title: string }>).map((entry) => entry.title)).toEqual(["Evil 2FA"]);1026+  });1027+9651028   it("PB-26-201: summon capability is one-shot after inventory authorization", async () => {9661029     const vault = await import("./vault");9671030     const messages = await import("./messages");@@ -1015,15 +1078,193 @@10151078     expect(first.id).not.toBe(second.id);10161079   });10171080 1018-  it("PB-26-201: summon capability rejects wrong operation and sender", async () => {1081+  it("PB-26-201: fill before inventory is rejected without an entry oracle", async () => {10191082     const vault = await import("./vault");10201083     const messages = await import("./messages");10211084     await vault.createVault("correct-pass-12345");1022-    const entry = await vault.addEntry({ title: "GitHub", password: "secret123", url: "https://github.com" });1085+    const entry = await addPasskeyOnlyEntry("GitHub passkey", "https://github.com");10231086     const token = messages.createSummonCapability(1, "https://evil.example.com");1024-    const wrongSender = tabSender("https://other.example.com/phish");1025-    const result = await dispatch({ type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } }, wrongSender);1087+    const result = await dispatch(1088+      { type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } },1089+      tabSender("https://evil.example.com/phish"),1090+    );10261091     expect(result).toMatchObject({ ok: false, error: "entry_not_found" });1092+  });1093+1094+  it("PB-26-201: an unused summon capability does not block a normal same-origin fill", async () => {1095+    const vault = await import("./vault");1096+    const messages = await import("./messages");1097+    await vault.createVault("correct-pass-12345");1098+    const entry = await vault.addEntry({1099+      title: "Evil",1100+      password: "known",1101+      url: "https://evil.example.com",1102+    });1103+    const sender = tabSender("https://evil.example.com/login");1104+    const token = messages.createSummonCapability(1, "https://evil.example.com");1105+1106+    const result = await dispatch(1107+      { type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } },1108+      sender,1109+    );1110+1111+    expect(result).toMatchObject({ ok: true, data: { id: entry.id } });1112+  });1113+1114+  it("PB-26-201: expired fill capability is rejected before entry-specific errors", async () => {1115+    vi.useFakeTimers();1116+    vi.setSystemTime(new Date("2026-09-02T12:00:00Z"));1117+    const vault = await import("./vault");1118+    const messages = await import("./messages");1119+    await vault.createVault("correct-pass-12345");1120+    const entry = await addPasskeyOnlyEntry("GitHub passkey", "https://github.com");1121+    const sender = tabSender("https://evil.example.com/phish");1122+    const token = messages.createSummonCapability(1, "https://evil.example.com");1123+    await dispatch({ type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } }, sender);1124+    vi.advanceTimersByTime(30_001);1125+1126+    const result = await dispatch({ type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } }, sender);1127+    expect(result).toMatchObject({ ok: false, error: "entry_not_found" });1128+  });1129+1130+  it("PB-26-201: wrong-tab fill capability is rejected before entry-specific errors", async () => {1131+    const vault = await import("./vault");1132+    const messages = await import("./messages");1133+    await vault.createVault("correct-pass-12345");1134+    const entry = await addPasskeyOnlyEntry("GitHub passkey", "https://github.com");1135+    const token = messages.createSummonCapability(1, "https://evil.example.com");1136+    await dispatch(1137+      { type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } },1138+      tabSender("https://evil.example.com/phish"),1139+    );1140+1141+    const result = await dispatch(1142+      { type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } },1143+      tabSender("https://evil.example.com/phish", 2),1144+    );1145+    expect(result).toMatchObject({ ok: false, error: "entry_not_found" });1146+  });1147+1148+  it("PB-26-201: wrong-frame fill capability is rejected before entry-specific errors", async () => {1149+    const vault = await import("./vault");1150+    const messages = await import("./messages");1151+    await vault.createVault("correct-pass-12345");1152+    const entry = await addPasskeyOnlyEntry("GitHub passkey", "https://github.com");1153+    const token = messages.createSummonCapability(1, "https://evil.example.com", 3);1154+    await dispatch(1155+      { type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } },1156+      tabSender("https://evil.example.com/phish", 1, 3),1157+    );1158+1159+    const result = await dispatch(1160+      { type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } },1161+      tabSender("https://evil.example.com/phish", 1, 4),1162+    );1163+    expect(result).toMatchObject({ ok: false, error: "entry_not_found" });1164+  });1165+1166+  it("PB-26-201: wrong-origin fill capability is rejected before entry-specific errors", async () => {1167+    const vault = await import("./vault");1168+    const messages = await import("./messages");1169+    await vault.createVault("correct-pass-12345");1170+    const entry = await addPasskeyOnlyEntry("GitHub passkey", "https://github.com");1171+    const token = messages.createSummonCapability(1, "https://evil.example.com");1172+    await dispatch(1173+      { type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } },1174+      tabSender("https://evil.example.com/phish"),1175+    );1176+1177+    const result = await dispatch(1178+      { type: "GET_ENTRY_FOR_FILL", payload: { id: entry.id, capability: token } },1179+      tabSender("https://other.example.com/phish"),1180+    );1181+    expect(result).toMatchObject({ ok: false, error: "entry_not_found" });1182+  });1183+1184+  it("PB-26-201: selecting a missing id consumes the one-shot capability without an oracle", async () => {1185+    const vault = await import("./vault");1186+    const messages = await import("./messages");1187+    await vault.createVault("correct-pass-12345");1188+    const existing = await addPasskeyOnlyEntry("GitHub passkey", "https://github.com");1189+    const sender = tabSender("https://evil.example.com/phish");1190+    const token = messages.createSummonCapability(1, "https://evil.example.com");1191+    await dispatch({ type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } }, sender);1192+1193+    const missing = await dispatch(1194+      { type: "GET_ENTRY_FOR_FILL", payload: { id: "missing", capability: token } },1195+      sender,1196+    );1197+    const existingReplay = await dispatch(1198+      { type: "GET_ENTRY_FOR_FILL", payload: { id: existing.id, capability: token } },1199+      sender,1200+    );1201+    expect(missing).toMatchObject({ ok: false, error: "entry_not_found" });1202+    expect(existingReplay).toEqual(missing);1203+  });1204+1205+  it("PB-26-201: inventory capability cannot be reused for a second inventory", async () => {1206+    const vault = await import("./vault");1207+    const messages = await import("./messages");1208+    await vault.createVault("correct-pass-12345");1209+    await vault.addEntry({ title: "GitHub", password: "secret", url: "https://github.com" });1210+    const sender = tabSender("https://evil.example.com/phish");1211+    const token = messages.createSummonCapability(1, "https://evil.example.com");1212+    const first = await dispatch({ type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } }, sender);1213+    const second = await dispatch({ type: "AUTOFILL_QUERY", payload: { domain: "evil.example.com", capability: token } }, sender);1214+1215+    expect(first).toMatchObject({ ok: true, data: [{ title: "GitHub" }] });1216+    expect(second).toMatchObject({ ok: false, error: "entry_not_found" });1217+  });1218+1219+  it("PB-26-201: cards require a capability and consume it on the selected fill", async () => {1220+    const vault = await import("./vault");1221+    const messages = await import("./messages");1222+    await vault.createVault("correct-pass-12345");1223+    const card = await vault.addEntry({1224+      type: "card",1225+      title: "Personal Visa",1226+      cardholderName: "June Peach",1227+      cardNumber: "4111111111111111",1228+      cvc: "123",1229+      expMonth: "12",1230+      expYear: "2030",1231+    });1232+    const sender = tabSender("https://shop.example.com/checkout");1233+    const passive = await dispatch(1234+      { type: "AUTOFILL_QUERY", payload: { domain: "shop.example.com", kind: "card" } },1235+      sender,1236+    );1237+    expect(passive).toMatchObject({ ok: true, data: [] });1238+1239+    const token = messages.createSummonCapability(1, "https://shop.example.com");1240+    const inventory = await dispatch(1241+      { type: "AUTOFILL_QUERY", payload: { domain: "forged.example", kind: "card", capability: token } },1242+      sender,1243+    );1244+    expect(inventory).toMatchObject({ ok: true, data: [{ id: card.id, title: "Personal Visa" }] });1245+    expect((inventory.data as Array<Record<string, unknown>>)[0]).not.toHaveProperty("cardNumber");1246+1247+    const fill = await dispatch(1248+      { type: "GET_ENTRY_FOR_FILL", payload: { id: card.id, capability: token } },1249+      sender,1250+    );1251+    expect(fill).toMatchObject({ ok: true, data: { id: card.id, cardNumber: "4111111111111111" } });1252+    const replay = await dispatch(1253+      { type: "GET_ENTRY_FOR_FILL", payload: { id: card.id, capability: token } },1254+      sender,1255+    );1256+    expect(replay).toMatchObject({ ok: false, error: "entry_not_found" });1257+  });1258+1259+  it("PB-26-201: inline edit popup request stores only the selected entry id", async () => {1260+    const result = await dispatch(1261+      { type: "OPEN_POPUP", payload: { entryId: "entry-123" } },1262+      tabSender("https://example.com/login"),1263+    );1264+1265+    expect(result).toMatchObject({ ok: true });1266+    expect(sessionStorage.peach_open_entry).toBe("entry-123");1267+    expect(sessionStorage.peach_inline_unlock).toBeUndefined();10271268   });10281269 10291270   it("MV-1: tab request with a matching domain returns the entry", async () => {

@@ -108,7 +108,7 @@108108 import { isMessageSenderAllowed } from "./message-policy";109109 110110 const SUMMON_CAPABILITY_TTL_MS = 30_000;111-type SummonCapability = { tabId: number; frameId: number; origin: string; operation: "inventory" | "fill"; entryId?: string; expiresAt: number };111+type SummonCapability = { tabId: number; frameId: number; origin: string; operation: "inventory" | "fill"; expiresAt: number };112112 const summonCapabilities = new Map<string, SummonCapability>();113113 114114 export function createSummonCapability(tabId: number, origin: string, frameId = 0): string {@@ -117,16 +117,17 @@117117   return token;118118 }119119 120-function consumeSummonCapability(token: unknown, sender: Partial<chrome.runtime.MessageSender>, operation: "inventory" | "fill", entryId?: string): boolean {120+function consumeSummonCapability(token: unknown, sender: Partial<chrome.runtime.MessageSender>, operation: "inventory" | "fill"): boolean {121121   if (typeof token !== "string") return false;122122   const cap = summonCapabilities.get(token);123-  if (!cap || cap.expiresAt <= Date.now() || sender.tab?.id !== cap.tabId || (sender.frameId ?? 0) !== cap.frameId || attestedSenderOrigin(sender) !== cap.origin) return false;123+  if (!cap) return false;124+  if (cap.expiresAt <= Date.now()) {125+    summonCapabilities.delete(token);126+    return false;127+  }128+  if (sender.tab?.id !== cap.tabId || (sender.frameId ?? 0) !== cap.frameId || attestedSenderOrigin(sender) !== cap.origin) return false;124129   if (cap.operation !== operation) return false;125130   if (operation === "inventory") cap.operation = "fill";126-  else if (cap.entryId === undefined) {127-    if (entryId === undefined) return false;128-    summonCapabilities.delete(token);129-  } else if (cap.entryId !== entryId) return false;130131   else summonCapabilities.delete(token);131132   return true;132133 }@@ -797,6 +798,9 @@797798           capability?: string;798799         };799800         const includeAll = consumeSummonCapability(capability, sender, "inventory");801+        if (capability !== undefined && !includeAll) {802+          return { ok: false, error: "entry_not_found" };803+        }800804         // kind="card": return saved cards as compact summaries for the801805         // inline card silver platter. Cards are not domain-scoped — every802806         // saved card is a candidate on every checkout page — so domain is@@ -817,11 +821,21 @@817821             })),818822           };819823         }824+        const scopedDomain = isPageSender(sender)825+          ? attestedSenderDomain(sender)826+          : typeof domain === "string"827+            ? extractDomain(domain)828+            : null;829+        if (!includeAll && !scopedDomain) {830+          return isPageSender(sender)831+            ? { ok: false, error: "origin_unverified" }832+            : { ok: true, data: [] };833+        }820834         if (kind === "totp") {821835           const matches = (822836             includeAll823837               ? vault.getEntries().filter((entry) => entry.type !== "note" && entry.type !== "card")824-              : vault.queryDomain(domain)838+              : vault.queryDomain(scopedDomain!)825839           ).filter((entry) => !isPasskeyOnly(entry) && Boolean(entry.totp));826840           return {827841             ok: true,@@ -845,7 +859,7 @@845859             ? vault846860                 .getEntries()847861                 .filter((entry) => entry.type !== "note" && entry.type !== "card")848-            : vault.queryDomain(domain)862+            : vault.queryDomain(scopedDomain!)849863         ).filter((entry) => !isPasskeyOnly(entry));850864         return {851865           ok: true,@@ -882,12 +896,13 @@882896           id: string;883897           capability?: string;884898         };899+        const capabilityAuthorized = capability !== undefined && consumeSummonCapability(capability, sender, "fill");900+        const senderDomain = isPageSender(sender) ? attestedSenderDomain(sender) : null;901+        if (isPageSender(sender) && !senderDomain) {902+          return { ok: false, error: "origin_unverified" };903+        }885904         const entry = vault.getEntryById(id);886905         if (!entry) return { ok: false, error: "entry_not_found" };887-        // Passkey-only entries (passkey credential, no password) cannot be888-        // filled into a form — sign-in goes through the WebAuthn path. A889-        // login that ALSO has a passkey is still fillable for its password.890-        if (isPasskeyOnly(entry)) return { ok: false, error: "passkey_not_fillable" };891906 892907         // MV-1: re-validate the entry against the requesting frame's origin.893908         // sender.url / sender.tab.url are browser-attested — a page cannot@@ -896,36 +911,16 @@896911         // misattribute a cross-origin iframe's request to the top page. When897912         // the request does not come from a tab at all (popup surfaces use898913         // GET_ENTRY_FOR_EDIT, not this), refuse.899-        if (sender.tab !== undefined || sender.url !== undefined) {900-          let senderDomain: string | null = null;901-          try {902-            const rawUrl = sender.url ?? sender.tab?.url ?? "";903-            senderDomain = rawUrl ? extractDomain(new URL(rawUrl).hostname) : null;904-          } catch {905-            senderDomain = null;906-          }907-          if (!senderDomain) return { ok: false, error: "origin_unverified" };908-909-          const entryDomains = new Set<string>();910-          const primary = extractDomain(entry.url ?? "");911-          if (primary) entryDomains.add(primary);912-          for (const extra of entry.additionalUrls ?? []) {913-            const d = extractDomain(extra);914-            if (d) entryDomains.add(d);915-          }916-917-          // Consume a summon capability even when the selected entry already918-          // matches the page origin; otherwise a same-domain fill leaves the919-          // bearer reusable for a later off-domain request.920-          const capabilityAuthorized = capability !== undefined && consumeSummonCapability(capability, sender, "fill", id);921-          // explicitSummon=true means the user actively picked this entry922-          // from the cross-domain search affordance — an intentional923-          // off-domain fill. Passive fill paths must stay domain-bound.924-          if (!entryDomains.has(senderDomain) && !capabilityAuthorized) {914+        if (senderDomain && !capabilityAuthorized) {915+          if (!entryDomains(entry.url, entry.additionalUrls).has(senderDomain)) {925916             // Domain mismatch — refuse silently (no oracle about which ids exist).926917             return { ok: false, error: "entry_not_found" };927918           }928919         }920+        // Passkey-only entries (passkey credential, no password) cannot be921+        // filled into a form — sign-in goes through the WebAuthn path. A922+        // login that ALSO has a passkey is still fillable for its password.923+        if (isPasskeyOnly(entry)) return { ok: false, error: "passkey_not_fillable" };929924         // Strip the passkey credential AND the raw base32 TOTP seed from the930925         // response. Content scripts never need either: the private key is the931926         // authenticator's, and handing over the TOTP seed would let a@@ -960,54 +955,15 @@960955         }961956         return { ok: true, data: { ...safeEntry, totpCode, totpRemaining } };962957       }963-      // Trusted full-entry fetch for Peach's own inline-popup surfaces that964-      // genuinely need the raw TOTP seed: the edit form (which re-saves the965-      // seed and would otherwise wipe it) and nothing else. Unlike966-      // GET_ENTRY_FOR_FILL this fires only on an explicit user action inside967-      // the inline popup, never during passive autofill on an arbitrary page.968-      // The passkey credential is still stripped — the edit form never touches it.958+      // Trusted full-entry fetch for extension-owned edit surfaces. Content959+      // scripts route editing to the popup and cannot call this message.969960       case "GET_ENTRY_FOR_EDIT": {970961         if (isPageSender(sender)) return { ok: false, error: "invalid_sender" };971962         if (!vault.isUnlocked()) return { ok: false, error: "vault_locked" };972-        const { id, capability } = msg.payload as {973-          id: string;974-          capability?: string;975-        };963+        const { id } = msg.payload as { id: string };976964         const entry = vault.getEntryById(id);977965         if (!entry) return { ok: false, error: "entry_not_found" };978966 979-        // PCH-01-006: re-validate the browser-attested sender origin, mirroring980-        // GET_ENTRY_FOR_FILL (MV-1). The edit channel ships the raw TOTP seed and981-        // full password history — at least as sensitive as the fill response — so982-        // the boundary must be enforced here, not only by UI reachability. Today983-        // the sole caller is the popup (no sender.tab, so this is a structural984-        // no-op), but a future tab-context caller or an id leak would otherwise985-        // inherit a full-credential oracle. Unlike the fill path we SKIP (not986-        // refuse) when no sender domain resolves, to keep the popup caller working.987-        // PB-26-005: the frame url (sender.url) is authoritative over the988-        // top-frame sender.tab.url — mirrors the fill path.989-        if (sender.tab !== undefined || sender.url !== undefined) {990-          let senderDomain: string | null = null;991-          try {992-            const rawUrl = sender.url ?? sender.tab?.url ?? "";993-            senderDomain = rawUrl ? extractDomain(new URL(rawUrl).hostname) : null;994-          } catch {995-            senderDomain = null;996-          }997-          if (senderDomain) {998-            const entryDomains = new Set<string>();999-            const primary = extractDomain(entry.url ?? "");1000-            if (primary) entryDomains.add(primary);1001-            for (const extra of entry.additionalUrls ?? []) {1002-              const d = extractDomain(extra);1003-              if (d) entryDomains.add(d);1004-            }1005-            if (!entryDomains.has(senderDomain) && !consumeSummonCapability(capability, sender, "fill", id)) {1006-              return { ok: false, error: "entry_not_found" }; // no id oracle1007-            }1008-          }1009-        }1010-1011967         const { passkey: _passkey, ...safeEntry } = entry;1012968         return { ok: true, data: safeEntry };1013969       }@@ -1235,8 +1191,16 @@12351191         // Set a session flag so the popup knows it was opened for inline unlock12361192         // and should close itself once the vault is unlocked (returning the user12371193         // to the inline autofill selector on the page).1194+        const { entryId } = (msg.payload ?? {}) as { entryId?: unknown };1195+        if (entryId !== undefined && (typeof entryId !== "string" || entryId.length === 0 || entryId.length > 64)) {1196+          return { ok: false, error: "invalid_payload" };1197+        }12381198         if (chrome.storage.session) {1239-          await chrome.storage.session.set({ peach_inline_unlock: true });1199+          if (typeof entryId === "string") {1200+            await chrome.storage.session.set({ peach_open_entry: entryId });1201+          } else {1202+            await chrome.storage.session.set({ peach_inline_unlock: true });1203+          }12401204         }12411205         try { await chrome.action.openPopup(); } catch { /* user opens via toolbar */ }12421206         return { ok: true };

@@ -36,7 +36,7 @@3636 3737 import { afterEach, beforeEach, describe, expect, it } from "vitest";3838 import "./_setup";39-import { setMessageResponder, resetChromeMock, makeInput, createLoginForm, createEmailFirstForm } from "./_setup";39+import { setMessageResponder, resetChromeMock, sentMessages, makeInput, createLoginForm, createEmailFirstForm } from "./_setup";4040 import { handleFieldInteraction } from "./index";4141 import { showAutofillSelector, showTOTPSelector } from "./inject";4242 @@ -190,5 +190,53 @@190190     await Promise.all([handleFieldInteraction(password), handleFieldInteraction(password)]);191191     await vi.waitFor(() => expect(showSelector).toHaveBeenCalled());192192     expect(showSelector).toHaveBeenCalledTimes(1);193+  });194+});195+196+describe("PB-26-201: browser-command capability propagation", () => {197+  it("passes the capability through form inventory and the selected fill", async () => {198+    const { password } = createLoginForm();199+    setMessageResponder((msg) => {200+      if (msg.type === "AUTOFILL_QUERY") {201+        return { ok: true, data: [{ id: "foreign-entry", title: "Foreign", username: "alice" }] };202+      }203+      if (msg.type === "GET_ENTRY_FOR_FILL") {204+        return { ok: true, data: { id: "foreign-entry", title: "Foreign", username: "alice", password: "secret" } };205+      }206+      return { ok: true, data: null };207+    });208+209+    await handleFieldInteraction(password, true, "form-capability");210+    await vi.waitFor(() => expect(showSelector).toHaveBeenCalled());211+212+    expect(sentMessages.find((msg) => msg.type === "AUTOFILL_QUERY")).toMatchObject({213+      payload: { includeAll: true, capability: "form-capability" },214+    });215+    const onSelect = showSelector.mock.calls.at(-1)![2] as (id: string) => Promise<void>;216+    await onSelect("foreign-entry");217+    expect(sentMessages.find((msg) => msg.type === "GET_ENTRY_FOR_FILL")).toMatchObject({218+      payload: { id: "foreign-entry", capability: "form-capability" },219+    });220+  });221+222+  it("passes the capability through TOTP inventory and the selected fill", async () => {223+    const totp = makeInput({ type: "text", autocomplete: "one-time-code", name: "otp" });224+    setMessageResponder((msg) => {225+      if (msg.type === "AUTOFILL_QUERY") return { ok: true, data: [{ id: "totp-entry", title: "Foreign 2FA" }] };226+      if (msg.type === "GET_ENTRY_FOR_FILL") return { ok: true, data: { id: "totp-entry", totpCode: "123456" } };227+      return { ok: true, data: null };228+    });229+230+    await handleFieldInteraction(totp, true, "totp-capability");231+    await vi.waitFor(() => expect(showTOTP).toHaveBeenCalled());232+    expect(sentMessages.find((msg) => msg.type === "AUTOFILL_QUERY")).toMatchObject({233+      payload: { kind: "totp", capability: "totp-capability" },234+    });235+236+    const onSelect = showTOTP.mock.calls.at(-1)![2] as (id: string) => Promise<void>;237+    await onSelect("totp-entry");238+    expect(sentMessages.find((msg) => msg.type === "GET_ENTRY_FOR_FILL")).toMatchObject({239+      payload: { id: "totp-entry", capability: "totp-capability" },240+    });193241   });194242 });

@@ -35,11 +35,12 @@3535 3636 import { afterEach, beforeEach, describe, expect, it } from "vitest";3737 import "./_setup";38-import { resetChromeMock, setMessageResponder, messageListeners, createLoginForm, makeInput } from "./_setup";38+import { resetChromeMock, setMessageResponder, sentMessages, messageListeners, createLoginForm, makeInput } from "./_setup";3939 import "./index"; // registers the onMessage listener at import time4040 import * as inject from "./inject";4141 4242 const showSelector = inject.showAutofillSelector as unknown as ReturnType<typeof vi.fn>;43+const showCardSelector = inject.showCardSelector as unknown as ReturnType<typeof vi.fn>;4344 const showPasskeyProGate = inject.showPasskeyProGate as unknown as ReturnType<typeof vi.fn>;4445 const SELF_SENDER = { id: "peach-test-extension-id" };4546 const ENTRIES = [{ id: "e1", title: "Acme", username: "alice" }];@@ -65,6 +66,7 @@6566   await new Promise((r) => setTimeout(r, 0));6667   resetChromeMock();6768   showSelector.mockClear();69+  showCardSelector.mockClear();6870   showPasskeyProGate.mockClear();6971   predictBatch.mockReset();7072   predictBatch.mockReturnValue(Promise.resolve([]));@@ -90,6 +92,62 @@9092   it("T-M02: SUMMON_AUTOFILL with no login form → no crash, no credential selector", () => {9193     expect(() => dispatch({ type: "SUMMON_AUTOFILL", source: "shortcut" })).not.toThrow();9294     expect(showSelector).not.toHaveBeenCalled();95+  });96+97+  it("PB-26-201: no-form command carries capability from inventory to selected fill", async () => {98+    const originalAttachShadow = Element.prototype.attachShadow;99+    const attachSpy = vi.spyOn(Element.prototype, "attachShadow").mockImplementation(function (this: Element) {100+      return originalAttachShadow.call(this, { mode: "open" });101+    });102+    setMessageResponder((msg) => {103+      if (msg.type === "AUTOFILL_QUERY") return { ok: true, data: ENTRIES };104+      if (msg.type === "GET_ENTRY_FOR_FILL") return { ok: true, data: { ...ENTRIES[0], password: "secret" } };105+      return { ok: true, data: null };106+    });107+108+    try {109+      dispatch({ type: "SUMMON_AUTOFILL", source: "shortcut", capability: "no-form-capability" });110+      await vi.waitFor(() => {111+        expect(sentMessages.find((msg) => msg.type === "AUTOFILL_QUERY")).toMatchObject({112+          payload: { includeAll: true, capability: "no-form-capability" },113+        });114+      });115+      const findRow = () => Array.from(document.body.children)116+        .map((host) => host.shadowRoot?.querySelector<HTMLElement>(".e"))117+        .find((candidate): candidate is HTMLElement => candidate !== null && candidate !== undefined);118+      await vi.waitFor(() => expect(findRow()).toBeDefined());119+      const row = findRow();120+      row?.click();121+      await vi.waitFor(() => {122+        expect(sentMessages.find((msg) => msg.type === "GET_ENTRY_FOR_FILL")).toMatchObject({123+          payload: { id: "e1", capability: "no-form-capability" },124+        });125+      });126+    } finally {127+      attachSpy.mockRestore();128+    }129+  });130+131+  it("PB-26-201: card command carries capability into inventory and selector actions", async () => {132+    const form = document.createElement("form");133+    document.body.appendChild(form);134+    const number = makeInput({ type: "text", autocomplete: "cc-number" }, form);135+    makeInput({ type: "text", autocomplete: "cc-exp" }, form);136+    makeInput({ type: "text", autocomplete: "cc-csc" }, form);137+    number.focus();138+    setMessageResponder((msg) =>139+      msg.type === "AUTOFILL_QUERY"140+        ? { ok: true, data: [{ id: "card-1", title: "Personal Visa", last4: "1111" }] }141+        : { ok: true, data: null },142+    );143+144+    dispatch({ type: "SUMMON_AUTOFILL", source: "shortcut", capability: "card-capability" });145+146+    await vi.waitFor(() => expect(showCardSelector).toHaveBeenCalled());147+    expect(sentMessages.find((msg) => msg.type === "AUTOFILL_QUERY" && msg.payload?.kind === "card")).toMatchObject({148+      payload: { capability: "card-capability" },149+    });150+    expect(showCardSelector.mock.calls.at(-1)![2]).toMatchObject({ capability: "card-capability" });93151   });94152 });95153 

@@ -17,8 +17,8 @@1717 1818 import "./_setup"; // chrome mock + ResizeObserver polyfill1919 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";20-import { showAutofillSelector } from "./inject";21-import { makeInput } from "./_setup";20+import { showAutofillSelector, showCardSelector } from "./inject";21+import { makeInput, resetChromeMock, sentMessages, setMessageResponder } from "./_setup";2222 2323 const ENTRIES = [2424   { id: "e1", title: "Acme", username: "[email protected]" },@@ -33,6 +33,7 @@3333 3434 beforeEach(() => {3535   document.body.innerHTML = "";36+  resetChromeMock();3637 });3738 afterEach(() => {3839   document.body.innerHTML = "";@@ -79,5 +80,165 @@7980     expect(document.body.querySelectorAll('div[style*="2147483647"]').length).toBe(2);8081     d1();8182     d2();83+  });84+});85+86+describe("PB-26-201: content-safe privileged actions", () => {87+  it("uses a command capability for exactly one login-with-TOTP secret fetch", async () => {88+    const originalAttachShadow = Element.prototype.attachShadow;89+    const attachSpy = vi.spyOn(Element.prototype, "attachShadow").mockImplementation(function (this: Element) {90+      return originalAttachShadow.call(this, { mode: "open" });91+    });92+    const anchor = makeInput({ type: "password" });93+    const onSelect = vi.fn(async (id: string) => {94+      await chrome.runtime.sendMessage({95+        type: "GET_ENTRY_FOR_FILL",96+        payload: { id, capability: "login-capability" },97+      });98+    });99+    setMessageResponder((message) =>100+      message.type === "GET_ENTRY_FOR_FILL"101+        ? { ok: true, data: { password: "secret", totpCode: "123456" } }102+        : { ok: true, data: null },103+    );104+105+    try {106+      const dismiss = showAutofillSelector(107+        anchor,108+        [{ id: "e1", title: "Acme", username: "alice", hasTotp: true }],109+        onSelect,110+        { domain: "example.com", capability: "login-capability" },111+      );112+      const host = selectorHost();113+      expect(sentMessages.some((message) => message.type === "GET_ENTRY_FOR_FILL")).toBe(false);114+      host?.shadowRoot?.querySelector<HTMLButtonElement>(".sp-fill-btn")?.click();115+116+      await vi.waitFor(() => expect(onSelect).toHaveBeenCalledWith("e1"));117+      expect(sentMessages.filter((message) => message.type === "GET_ENTRY_FOR_FILL")).toHaveLength(1);118+      dismiss();119+    } finally {120+      attachSpy.mockRestore();121+    }122+  });123+124+  it("passes the command capability into a selected password copy", async () => {125+    const originalAttachShadow = Element.prototype.attachShadow;126+    const attachSpy = vi.spyOn(Element.prototype, "attachShadow").mockImplementation(function (this: Element) {127+      return originalAttachShadow.call(this, { mode: "open" });128+    });129+    const anchor = makeInput({ type: "password" });130+    setMessageResponder((message) =>131+      message.type === "GET_ENTRY_FOR_FILL"132+        ? { ok: true, data: { password: "correct horse battery staple" } }133+        : { ok: true, data: null },134+    );135+136+    try {137+      const dismiss = showAutofillSelector(anchor, [ENTRIES[0]!], vi.fn(), {138+        domain: "example.com",139+        capability: "login-capability",140+      } as Parameters<typeof showAutofillSelector>[3]);141+      const host = selectorHost();142+      host?.shadowRoot?.querySelector<HTMLButtonElement>('button[title="Copy password"]')?.click();143+144+      await vi.waitFor(() => {145+        expect(sentMessages.find((message) => message.type === "GET_ENTRY_FOR_FILL")).toMatchObject({146+          payload: { id: "e1", capability: "login-capability" },147+        });148+      });149+      dismiss();150+    } finally {151+      attachSpy.mockRestore();152+    }153+  });154+155+  it("routes inline edit to the extension popup without requesting raw edit data", async () => {156+    const originalAttachShadow = Element.prototype.attachShadow;157+    const attachSpy = vi.spyOn(Element.prototype, "attachShadow").mockImplementation(function (this: Element) {158+      return originalAttachShadow.call(this, { mode: "open" });159+    });160+    const anchor = makeInput({ type: "password" });161+162+    try {163+      const dismiss = showAutofillSelector(anchor, [ENTRIES[0]!], vi.fn(), { domain: "example.com" });164+      const host = selectorHost();165+      const edit = host?.shadowRoot?.querySelector<HTMLButtonElement>(".sp-action-edit");166+      expect(edit).not.toBeNull();167+      edit?.click();168+169+      await vi.waitFor(() => {170+        expect(sentMessages).toContainEqual({ type: "OPEN_POPUP", payload: { entryId: "e1" } });171+      });172+      expect(sentMessages.some((message) => message.type === "GET_ENTRY_FOR_EDIT")).toBe(false);173+      dismiss();174+    } finally {175+      attachSpy.mockRestore();176+    }177+  });178+179+  it("passes the card command capability into the selected card fill", async () => {180+    const originalAttachShadow = Element.prototype.attachShadow;181+    const attachSpy = vi.spyOn(Element.prototype, "attachShadow").mockImplementation(function (this: Element) {182+      return originalAttachShadow.call(this, { mode: "open" });183+    });184+    const anchor = makeInput({ type: "text", autocomplete: "cc-number" });185+    const onFill = vi.fn();186+    setMessageResponder((message) =>187+      message.type === "GET_ENTRY_FOR_FILL"188+        ? { ok: true, data: { id: "card-1", type: "card", title: "Personal Visa", cardNumber: "4111111111111111" } }189+        : { ok: true, data: null },190+    );191+192+    try {193+      const dismiss = showCardSelector(194+        anchor,195+        [{ id: "card-1", title: "Personal Visa", last4: "1111" }],196+        { domain: "shop.example", capability: "card-capability", onFill } as Parameters<typeof showCardSelector>[2],197+      );198+      const host = selectorHost();199+      host?.shadowRoot?.querySelector<HTMLButtonElement>(".sp-fill-btn")?.click();200+201+      await vi.waitFor(() => {202+        expect(sentMessages.find((message) => message.type === "GET_ENTRY_FOR_FILL")).toMatchObject({203+          payload: { id: "card-1", capability: "card-capability" },204+        });205+      });206+      dismiss();207+    } finally {208+      attachSpy.mockRestore();209+    }210+  });211+212+  it("allows only one card secret action per command capability", async () => {213+    const originalAttachShadow = Element.prototype.attachShadow;214+    const attachSpy = vi.spyOn(Element.prototype, "attachShadow").mockImplementation(function (this: Element) {215+      return originalAttachShadow.call(this, { mode: "open" });216+    });217+    const anchor = makeInput({ type: "text", autocomplete: "cc-number" });218+    setMessageResponder((message) =>219+      message.type === "GET_ENTRY_FOR_FILL"220+        ? { ok: true, data: { id: "card-1", type: "card", cardNumber: "4111111111111111", cvc: "123" } }221+        : { ok: true, data: null },222+    );223+224+    try {225+      const dismiss = showCardSelector(226+        anchor,227+        [{ id: "card-1", title: "Personal Visa", last4: "1111" }],228+        { domain: "shop.example", capability: "card-capability", onFill: vi.fn() },229+      );230+      const host = selectorHost();231+      const copyNumber = host?.shadowRoot?.querySelector<HTMLButtonElement>('button[title="Copy card number"]');232+      const fill = host?.shadowRoot?.querySelector<HTMLButtonElement>(".sp-fill-btn");233+      copyNumber?.click();234+      fill?.click();235+236+      await vi.waitFor(() => {237+        expect(sentMessages.filter((message) => message.type === "GET_ENTRY_FOR_FILL")).toHaveLength(1);238+      });239+      dismiss();240+    } finally {241+      attachSpy.mockRestore();242+    }82243   });83244 });